{"vulnerability": "2026-28", "sightings": [{"uuid": "3c742ce2-bc55-41aa-84f5-43b46da2c2e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28405", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgdsamkleb24", "content": "", "creation_timestamp": "2026-03-05T21:59:32.892216Z"}, {"uuid": "c74b51e7-757f-4690-afa0-66de7a864358", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28501", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mghp2medd52z", "content": "", "creation_timestamp": "2026-03-07T11:13:09.141382Z"}, {"uuid": "3f9cab72-cecc-4d91-a491-fdb0a2942c90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28790", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgdsilvrhp2o", "content": "", "creation_timestamp": "2026-03-05T22:04:00.593887Z"}, {"uuid": "3b2544e4-f72b-4c97-bff7-8070b079c740", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28544", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgck5tdvvn2o", "content": "", "creation_timestamp": "2026-03-05T10:02:09.726010Z"}, {"uuid": "9e6ef909-ceb1-48f6-b7fd-acbcff8468ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28442", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgdsrxp3e62z", "content": "", "creation_timestamp": "2026-03-05T22:09:15.019648Z"}, {"uuid": "379f8f1a-6439-4b24-8b92-682289cb6b35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28413", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgdsxdnyql2k", "content": "", "creation_timestamp": "2026-03-05T22:12:15.417009Z"}, {"uuid": "79712eed-2312-4ad1-b405-42ec618b7853", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28542", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgckbxqgub2y", "content": "", "creation_timestamp": "2026-03-05T10:04:28.596666Z"}, {"uuid": "322ab259-530b-4848-b427-4c6fa53d8397", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28548", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgckgh5hax2u", "content": "", "creation_timestamp": "2026-03-05T10:06:58.809875Z"}, {"uuid": "0988af53-1bb6-4504-a915-7f1f2b06f1f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28518", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mg63d4ft7v2x", "content": "", "creation_timestamp": "2026-03-03T15:26:04.004541Z"}, {"uuid": "ce4e63e6-b141-4d11-9e8d-7ec8ef8fa6af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28539", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgckldj6pc2d", "content": "", "creation_timestamp": "2026-03-05T10:09:43.050106Z"}, {"uuid": "ced546a9-863f-4352-881b-d66353d15af0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2855", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116102570574864032", "content": "", "creation_timestamp": "2026-02-20T10:50:34.543548Z"}, {"uuid": "5d48ff9f-5d84-4961-9e46-364aea059f8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28546", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgckqpit7z2o", "content": "", "creation_timestamp": "2026-03-05T10:12:43.353970Z"}, {"uuid": "cd2a5e21-73f7-483e-86c3-5409026b1262", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2857", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116102623829788393", "content": "", "creation_timestamp": "2026-02-20T11:04:07.113635Z"}, {"uuid": "e7502171-e0f6-4197-b7ba-1ec5d0fc8d97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28417", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mg63tdu3sd26", "content": "", "creation_timestamp": "2026-03-03T15:35:06.818832Z"}, {"uuid": "50cb46ad-5b0c-4600-88dd-83b9c02f9994", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28436", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgdtunnjmb2n", "content": "", "creation_timestamp": "2026-03-05T22:28:39.092504Z"}, {"uuid": "abb0f6e2-1ca6-4441-9ee7-8d3712dd95af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28418", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mg63tdu3sd26", "content": "", "creation_timestamp": "2026-03-03T15:35:06.924026Z"}, {"uuid": "4df145a3-96c2-4785-89fe-e8cc9da4481f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28492", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgdu5m462m27", "content": "", "creation_timestamp": "2026-03-05T22:33:39.428365Z"}, {"uuid": "b9fec1d6-8c05-4ea0-a4d5-0c2341a1080b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28419", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mg63tdu3sd26", "content": "", "creation_timestamp": "2026-03-03T15:35:07.017241Z"}, {"uuid": "4cb4a6fb-6cb0-4f1f-808f-eebde9055aa6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28443", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgdugkkhgh2o", "content": "", "creation_timestamp": "2026-03-05T22:38:39.717544Z"}, {"uuid": "0e3cf843-f72b-48b9-9081-c4ba96e52bc5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28420", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mg63tdu3sd26", "content": "", "creation_timestamp": "2026-03-03T15:35:07.101545Z"}, {"uuid": "178f262d-7f7b-4878-a4b3-61e28a11af1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28421", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mg63tdu3sd26", "content": "", "creation_timestamp": "2026-03-03T15:35:07.194102Z"}, {"uuid": "4f0ea3cd-c580-41d7-b788-9c49e0009ed6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28422", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mg63tdu3sd26", "content": "", "creation_timestamp": "2026-03-03T15:35:07.275927Z"}, {"uuid": "44195ee7-ad75-4abc-8e75-32016558c271", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28400", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mg63toxnbl2z", "content": "", "creation_timestamp": "2026-03-03T15:35:18.478108Z"}, {"uuid": "e73e79ba-30e9-4db1-9336-cd110848c40b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28435", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgdyyifisu2u", "content": "", "creation_timestamp": "2026-03-06T00:00:16.569093Z"}, {"uuid": "630bb660-6be5-464c-a4b8-1a0541cc90dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28485", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf3fkplqs25", "content": "", "creation_timestamp": "2026-03-06T10:16:02.926206Z"}, {"uuid": "efea9e58-fad5-45fe-8335-6cfc18719b58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28562", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116153452214600644", "content": "", "creation_timestamp": "2026-03-01T10:30:27.059096Z"}, {"uuid": "b35b2b46-536b-4567-ba2d-e5359f6d8f2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28478", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf3frgokj2x", "content": "", "creation_timestamp": "2026-03-06T10:16:10.470978Z"}, {"uuid": "bec79042-f91c-4082-983d-675904ca2380", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28562", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mfyjuri77z2m", "content": "", "creation_timestamp": "2026-03-01T10:30:29.026856Z"}, {"uuid": "d5ef3e0c-e4f0-489e-a940-51729da3ae00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28542", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mge242zrvj2q", "content": "", "creation_timestamp": "2026-03-06T00:20:10.377669Z"}, {"uuid": "017a8601-a8f0-4dd1-b79f-ae3e730cd627", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28485", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf3ggvbaz2x", "content": "", "creation_timestamp": "2026-03-06T10:16:33.066624Z"}, {"uuid": "95a1cde8-eb3a-46d1-98a8-a868a8febf67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28478", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf3gof6hk2c", "content": "", "creation_timestamp": "2026-03-06T10:16:40.160440Z"}, {"uuid": "30201053-bbe4-4809-8ef8-eb1744986a4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28548", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mge4dq6nek2x", "content": "", "creation_timestamp": "2026-03-06T01:00:14.947879Z"}, {"uuid": "8ef06f63-c208-483e-9401-0e5e2aa77d62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mge4yc6pne2j", "content": "", "creation_timestamp": "2026-03-06T01:11:45.446174Z"}, {"uuid": "45da2e55-2299-422c-ab96-b2447365a320", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28479", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf3gvsp7j26", "content": "", "creation_timestamp": "2026-03-06T10:16:49.286883Z"}, {"uuid": "9c335ea0-2f74-4799-b615-d13829673c33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28772", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg7sbhoj4d2o", "content": "", "creation_timestamp": "2026-03-04T07:49:22.394668Z"}, {"uuid": "4d5b7971-0466-4608-ac93-7492d197fa66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mg7scg3tko25", "content": "", "creation_timestamp": "2026-03-04T07:49:54.761218Z"}, {"uuid": "39b509bf-eb85-4424-9330-f3ff50445485", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28372", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mfu7c6ijjb2z", "content": "", "creation_timestamp": "2026-02-27T17:10:28.081435Z"}, {"uuid": "4f5a0b2c-d63f-4841-9a49-f26c241d8f8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28215", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfynrf7jr22h", "content": "", "creation_timestamp": "2026-03-01T11:40:10.917703Z"}, {"uuid": "0ac577ff-9e1d-4b06-8029-73d79f034ae7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28479", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf3hd7uxz2x", "content": "", "creation_timestamp": "2026-03-06T10:17:02.165596Z"}, {"uuid": "d37535ff-adc3-4888-b1a3-3a1dd1021588", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28363", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfsuixv7xg25", "content": "", "creation_timestamp": "2026-02-27T04:24:46.151684Z"}, {"uuid": "f5539afb-24a5-4145-b802-a1fbbebca298", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28472", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf3hk6wzw2c", "content": "", "creation_timestamp": "2026-03-06T10:17:09.225060Z"}, {"uuid": "c0462c81-efa7-40b4-91bc-bcb52bd7bb26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28364", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfsuj76ohg2x", "content": "", "creation_timestamp": "2026-02-27T04:24:53.836873Z"}, {"uuid": "da27c468-04ee-4296-b265-89918669a466", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28775", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg7smsqkfc2u", "content": "", "creation_timestamp": "2026-03-04T07:55:43.421867Z"}, {"uuid": "b4f29a2b-46ed-4e57-a75b-65b61a63c36e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28473", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf3hqrqru2k", "content": "", "creation_timestamp": "2026-03-06T10:17:17.157265Z"}, {"uuid": "8701eb33-339e-47ee-8c39-2e1f192e0a24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28775", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116172684996762067", "content": "", "creation_timestamp": "2026-03-04T20:01:35.753477Z"}, {"uuid": "ec84a626-e742-4e76-85b3-50ca1f18dd70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28363", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfsujvdclc2u", "content": "", "creation_timestamp": "2026-02-27T04:25:16.432948Z"}, {"uuid": "89160a90-2a32-40ed-9c33-e00031305232", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28364", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfsuk4rdbu26", "content": "", "creation_timestamp": "2026-02-27T04:25:24.622244Z"}, {"uuid": "773dbe9a-047b-462c-956d-49ca401b89ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28391", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mge5xtwrq22u", "content": "", "creation_timestamp": "2026-03-06T01:29:23.804384Z"}, {"uuid": "64d5f49a-ca34-483c-b314-17d8e5950ead", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28771", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg7t376rgn2v", "content": "", "creation_timestamp": "2026-03-04T08:03:46.115751Z"}, {"uuid": "f144a109-6332-43ca-9be0-a04f147823b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28392", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mge5zozba72h", "content": "", "creation_timestamp": "2026-03-06T01:30:25.666504Z"}, {"uuid": "8bed904b-a324-46c7-bae6-0030b189f57c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28769", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg7te5ml3j27", "content": "", "creation_timestamp": "2026-03-04T08:08:46.424912Z"}, {"uuid": "5d568141-861e-4744-94d9-6fe6a35e552f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28774", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg7tn42i2v2d", "content": "", "creation_timestamp": "2026-03-04T08:13:46.614524Z"}, {"uuid": "96fdcef0-4b6f-4bb2-a3eb-2311266d6da8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28435", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgb44kqejo25", "content": "", "creation_timestamp": "2026-03-04T20:18:15.452269Z"}, {"uuid": "e0dae94b-9670-4994-8d91-584a6815491e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2880", "type": "seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3mfue4bp2322b", "content": "", "creation_timestamp": "2026-02-27T18:36:39.243411Z"}, {"uuid": "4bee42dc-2137-4a15-af0d-9301f5fff57b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28770", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg7tw2jqcu2u", "content": "", "creation_timestamp": "2026-03-04T08:18:47.180006Z"}, {"uuid": "c57930e8-1c5f-4a2b-aba9-86bc373959ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28482", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mge73hh2ib27", "content": "", "creation_timestamp": "2026-03-06T01:49:18.733352Z"}, {"uuid": "94d619a9-4d68-4363-8def-d59ddcd98a76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2805", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfpkzi73fj2k", "content": "", "creation_timestamp": "2026-02-25T20:57:06.705819Z"}, {"uuid": "ade356fd-735d-4e1e-a6f3-739b2a8556ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28773", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg7u6yydgj2o", "content": "", "creation_timestamp": "2026-03-04T08:23:47.480019Z"}, {"uuid": "14b3b694-f9f1-4293-9bcb-5248023bd5ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28484", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mge7h76scz2u", "content": "", "creation_timestamp": "2026-03-06T01:55:52.480027Z"}, {"uuid": "e58a2c6e-7239-4868-96fe-bce8eb4a7dfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28216", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfuhnuiv2q2e", "content": "", "creation_timestamp": "2026-02-27T19:40:10.446777Z"}, {"uuid": "df60b6c9-e170-4e02-b596-ad8bb876aa39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28476", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mghs2yjb5l2d", "content": "", "creation_timestamp": "2026-03-07T12:07:03.920877Z"}, {"uuid": "22442e72-ed9f-4850-9bbc-55cb6627d2b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28363", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfuirrwyc723", "content": "", "creation_timestamp": "2026-02-27T20:00:15.897227Z"}, {"uuid": "51d26dbf-4fa6-48a9-8741-097824c3a5b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28514", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116185656748107663", "content": "", "creation_timestamp": "2026-03-07T03:00:29.922453Z"}, {"uuid": "44a5f83e-7889-48f4-9df2-1f0e33a3d879", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28451", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mghs3af4py2c", "content": "", "creation_timestamp": "2026-03-07T12:07:11.737464Z"}, {"uuid": "3eba76bd-4dbf-4f92-93c4-e8abf1b7c982", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28514", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mggtjp2kcy22", "content": "", "creation_timestamp": "2026-03-07T03:00:31.755776Z"}, {"uuid": "48f4b5fe-be49-4567-b767-abb0b5e48a2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28447", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mghs3h6qck2u", "content": "", "creation_timestamp": "2026-03-07T12:07:19.192144Z"}, {"uuid": "0ceffb1d-f53c-4419-9960-96415a9c48b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28479", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf5mgg4o62k", "content": "", "creation_timestamp": "2026-03-06T10:55:40.699519Z"}, {"uuid": "cafe0b27-cbf0-487b-835f-f4fedf5f3206", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2883", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mghtw6k7yg2i", "content": "", "creation_timestamp": "2026-03-07T12:40:09.338685Z"}, {"uuid": "aa985aa3-2908-4c91-a721-590c5b907744", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28486", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mge7w4w5mz2u", "content": "", "creation_timestamp": "2026-03-06T02:04:13.485548Z"}, {"uuid": "9da0e186-cd57-4cb7-8ac2-4df8b158bed3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28474", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf5mnbo2o2k", "content": "", "creation_timestamp": "2026-03-06T10:55:47.871370Z"}, {"uuid": "6022b173-728b-44a0-b5f9-a6435ed28ccc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28468", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf5mu3zp52d", "content": "", "creation_timestamp": "2026-03-06T10:55:54.885716Z"}, {"uuid": "e762ec28-9b87-41ff-a233-9bb6c78e8c6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28518", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg67itz6ra2x", "content": "", "creation_timestamp": "2026-03-03T16:40:49.589994Z"}, {"uuid": "16c8d4c0-ba2b-4f22-979c-91ad35243b27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28274", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfum53753f22", "content": "", "creation_timestamp": "2026-02-27T21:00:15.545576Z"}, {"uuid": "2db6312c-7089-4ba4-a0db-60b350f6ab80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28370", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfsxmajhfh2d", "content": "", "creation_timestamp": "2026-02-27T05:20:17.428814Z"}, {"uuid": "3d6d9a7d-a0c5-4afe-860f-44d6592fc302", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28469", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf5xbd7qk2s", "content": "", "creation_timestamp": "2026-03-06T11:01:44.496639Z"}, {"uuid": "803ac80c-c5b3-4fff-9abd-a13fc659f8d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28391", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mghv4ui2ei2s", "content": "", "creation_timestamp": "2026-03-07T13:01:48.045891Z"}, {"uuid": "e9dba268-51ae-4a7c-80e3-6c45ba697d62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28470", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf5xialel2f", "content": "", "creation_timestamp": "2026-03-06T11:01:51.624868Z"}, {"uuid": "85291613-445b-4f84-9917-21ff39dda2d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28392", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mghv53eggy25", "content": "", "creation_timestamp": "2026-03-07T13:01:54.930989Z"}, {"uuid": "8d19ced3-e661-449e-a923-9b24a8828dd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28485", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgeaza5j5b2u", "content": "", "creation_timestamp": "2026-03-06T02:23:51.187835Z"}, {"uuid": "30280a01-5228-48c5-909a-84cb292d3173", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28463", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf5xp6xo62c", "content": "", "creation_timestamp": "2026-03-06T11:01:58.882732Z"}, {"uuid": "c2fc3695-1c9e-41e8-b57e-47bb1d9e738b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28393", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mghv5cb4wx2x", "content": "", "creation_timestamp": "2026-03-07T13:02:02.122968Z"}, {"uuid": "ee73cb95-38c0-4994-9921-0d0df484057d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28370", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfsxmz252f2s", "content": "", "creation_timestamp": "2026-02-27T05:20:43.120875Z"}, {"uuid": "28929368-09e3-42f6-ae47-e51169f4d7ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28501", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mghwvm7tas23", "content": "", "creation_timestamp": "2026-03-07T13:33:31.243554Z"}, {"uuid": "1710e27b-d741-4f42-8877-3a30b49d8542", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2886", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mghxbhyzql2m", "content": "", "creation_timestamp": "2026-03-07T13:40:10.208734Z"}, {"uuid": "78eb9d12-e080-4569-8042-766b7c3e65e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28464", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf6yrensm2c", "content": "", "creation_timestamp": "2026-03-06T11:20:28.781559Z"}, {"uuid": "8081fa95-d2da-47a1-80a3-443190eaebd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2877", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116103950788299095", "content": "", "creation_timestamp": "2026-02-20T16:41:34.966072Z"}, {"uuid": "3a8d085b-462a-414a-9f12-5daa3e503506", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28464", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf6zrj7ni2u", "content": "", "creation_timestamp": "2026-03-06T11:21:03.505647Z"}, {"uuid": "e2eec5d6-08bf-4aea-827b-17f4027b2520", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28465", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf6zzcvux2n", "content": "", "creation_timestamp": "2026-03-06T11:21:10.499539Z"}, {"uuid": "8e9516cb-1f65-4631-912f-f2a5bf85460a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28363", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfsy7m4mkk2k", "content": "", "creation_timestamp": "2026-02-27T05:31:06.242313Z"}, {"uuid": "f7c12376-c910-47db-b391-ca5b04c3e394", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28466", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf72auafm25", "content": "", "creation_timestamp": "2026-03-06T11:21:18.689295Z"}, {"uuid": "580d6253-2120-4995-8529-c1e1ef0309f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28442", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mghygni6bt2t", "content": "", "creation_timestamp": "2026-03-07T14:00:57.979288Z"}, {"uuid": "2f73d090-163e-41fd-8047-da0c42d5a7d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2801", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfr3zsgbyj2c", "content": "", "creation_timestamp": "2026-02-26T11:34:07.359675Z"}, {"uuid": "ef463bba-57af-4d4c-9005-d62315737cc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28364", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfsyhbrkec2k", "content": "", "creation_timestamp": "2026-02-27T05:35:23.541541Z"}, {"uuid": "bed6c40f-1e43-44b2-b67c-8b196e0849f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28481", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgebc6knig2y", "content": "", "creation_timestamp": "2026-03-06T02:28:51.497789Z"}, {"uuid": "c379ccf3-9435-4374-8920-d66b7d5bba18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28405", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mghyguv3cj2c", "content": "", "creation_timestamp": "2026-03-07T14:01:05.462102Z"}, {"uuid": "e525bd62-f226-4463-b029-e4b8df5fcaf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2803", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfr3zzax3c2s", "content": "", "creation_timestamp": "2026-02-26T11:34:14.580003Z"}, {"uuid": "beaf4d9f-2dc4-4a7d-a5df-b87e5f29e184", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28501", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mgi37r5o2226", "content": "", "creation_timestamp": "2026-03-07T14:50:47.008612Z"}, {"uuid": "cd8f3117-4215-4241-aad2-3e3d28e6c9c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28431", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116201580941905093", "content": "", "creation_timestamp": "2026-03-09T22:30:13.588167Z"}, {"uuid": "d1b6e3fa-2616-4fc5-9766-16f6065d5fe2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2881", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116104057007671449", "content": "", "creation_timestamp": "2026-02-20T17:08:35.517048Z"}, {"uuid": "4284bd24-87e9-460e-8384-28184d439cb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2882", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mffhdfchj52v", "content": "", "creation_timestamp": "2026-02-21T20:24:23.556052Z"}, {"uuid": "052b7d40-43a8-4639-b834-6dbdfeaff30a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2883", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mffhdp5bq52v", "content": "", "creation_timestamp": "2026-02-21T20:24:33.515482Z"}, {"uuid": "925cd727-0f19-4d63-a871-8c74d7ce0666", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2881", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mffhdx4uay2n", "content": "", "creation_timestamp": "2026-02-21T20:24:41.710070Z"}, {"uuid": "7c673f33-979b-4a0a-b1ec-f4a2e964c092", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28272", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgbap24giu22", "content": "", "creation_timestamp": "2026-03-04T21:40:10.354831Z"}, {"uuid": "c8ef047c-efa3-45d7-bf50-b1be1a9d986e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2884", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116104110171293955", "content": "", "creation_timestamp": "2026-02-20T17:22:06.779134Z"}, {"uuid": "730a1bbc-284f-4a4d-8d16-692fbc342740", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2885", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116104163122684263", "content": "", "creation_timestamp": "2026-02-20T17:35:37.564995Z"}, {"uuid": "48c6b596-f32a-49af-928e-581bde35c24d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2844", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfwe67bqls2n", "content": "", "creation_timestamp": "2026-02-28T13:43:06.627104Z"}, {"uuid": "30174abb-7246-4587-85c9-6655f7934fee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28456", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgfak34cje2s", "content": "", "creation_timestamp": "2026-03-06T11:48:03.982869Z"}, {"uuid": "97c1e87b-5356-4e96-aef9-429e6243b555", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2818", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfcnm2ogha2f", "content": "", "creation_timestamp": "2026-02-20T17:38:37.529325Z"}, {"uuid": "4f0838d4-5aa2-4566-b882-4c9949ffad35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2884", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mffkeuf6vt2u", "content": "", "creation_timestamp": "2026-02-21T21:18:53.948050Z"}, {"uuid": "fe6f5bc4-cb46-4227-9c1e-ec4faffd8330", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28458", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgfakcqgrx2d", "content": "", "creation_timestamp": "2026-03-06T11:48:12.194461Z"}, {"uuid": "3c8f1c7c-ae10-478d-b5fc-74cdc7f5ddcd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2885", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mffkf3kxom2k", "content": "", "creation_timestamp": "2026-02-21T21:19:01.183304Z"}, {"uuid": "9bda0c5f-3bbe-4601-a94c-008f5d0a29fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28462", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgfakkddap2d", "content": "", "creation_timestamp": "2026-03-06T11:48:19.374998Z"}, {"uuid": "c5310aa9-3f8f-4564-ac2d-bb78f784790b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2884", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mffkft7w432u", "content": "", "creation_timestamp": "2026-02-21T21:19:25.956922Z"}, {"uuid": "5c3bd510-25d3-4b3e-922e-9372ac55577b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28474", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116179994511844506", "content": "", "creation_timestamp": "2026-03-06T03:00:30.501008Z"}, {"uuid": "50926cfe-4fec-4aca-9f49-a4404625fa49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2885", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mffkg2bgyj26", "content": "", "creation_timestamp": "2026-02-21T21:19:33.245962Z"}, {"uuid": "7c619f39-03c5-4324-8c9a-79604076ac84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28275", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfuoegu7kb2e", "content": "", "creation_timestamp": "2026-02-27T21:40:10.425772Z"}, {"uuid": "0b5e9936-2f81-4825-a86f-6f5fa0a3fd8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28474", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mged2srv672u", "content": "", "creation_timestamp": "2026-03-06T03:00:33.239871Z"}, {"uuid": "ab88c22e-d581-4dc8-b210-60806763f264", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28547", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgcl5huv7p2v", "content": "", "creation_timestamp": "2026-03-05T10:19:51.344785Z"}, {"uuid": "e0d21fcb-6686-40f5-99e9-817bab55ab72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28372", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mgi4jupanz2h", "content": "", "creation_timestamp": "2026-03-07T15:14:20.087402Z"}, {"uuid": "e66d7814-b493-4bc5-a98e-44bf579c10eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28453", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgfbb63lsz2k", "content": "", "creation_timestamp": "2026-03-06T12:00:58.158459Z"}, {"uuid": "81b233fd-a72a-4e88-aa56-684938ebf23b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28474", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mgi4ldj7oc2o", "content": "", "creation_timestamp": "2026-03-07T15:15:08.857446Z"}, {"uuid": "c06b5ba9-cd5c-4fc2-b3e8-2d5e1d021c85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28497", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgeg353h542o", "content": "", "creation_timestamp": "2026-03-06T03:54:23.942211Z"}, {"uuid": "0b8bed0b-839a-412e-996b-b81f2e32349a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2880", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuosfvtuc2e", "content": "", "creation_timestamp": "2026-02-27T21:47:59.040088Z"}, {"uuid": "36426005-1d19-4644-99d7-35929691633b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28370", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mg6ergyozr2w", "content": "", "creation_timestamp": "2026-03-03T18:15:06.668281Z"}, {"uuid": "270cd78e-0f52-4fc6-a5fa-b3f1c204286b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28540", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgclo3us7k2y", "content": "", "creation_timestamp": "2026-03-05T10:29:09.387374Z"}, {"uuid": "3c6cd003-6390-4e79-893d-a4c52a497803", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28454", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgfbbeyupb2h", "content": "", "creation_timestamp": "2026-03-06T12:01:04.880181Z"}, {"uuid": "561bd3d4-da88-41db-9da5-08ef92754fd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28502", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgeganv5nl2x", "content": "", "creation_timestamp": "2026-03-06T03:57:29.311322Z"}, {"uuid": "92024cad-d5e1-4ce2-b8c0-808a0dde76c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28446", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgfbblotk425", "content": "", "creation_timestamp": "2026-03-06T12:01:12.076316Z"}, {"uuid": "cd2d0604-d0e7-4c69-bb1b-73c39964b471", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28536", "type": "seen", "source": "https://bsky.app/profile/secqube.com/post/3mgclwvrs4x22", "content": "", "creation_timestamp": "2026-03-05T10:34:05.271373Z"}, {"uuid": "8821c764-7163-4c36-8a1c-44d527dab376", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28551", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgclx2dhla2n", "content": "", "creation_timestamp": "2026-03-05T10:34:09.601505Z"}, {"uuid": "22d78c42-51da-43dc-9969-2279a963d888", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28552", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgcm7yrkk32o", "content": "", "creation_timestamp": "2026-03-05T10:39:10.024371Z"}, {"uuid": "83f27942-9bcb-46b7-9ef2-7510422b5fa3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28208", "type": "seen", "source": "https://gist.github.com/alon710/322eaec6115140d27bccb17e1450bfcd", "content": "", "creation_timestamp": "2026-02-27T22:40:11.000000Z"}, {"uuid": "505646bf-d103-4db6-a184-a1c67d5c3094", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28549", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgcmix7fe72d", "content": "", "creation_timestamp": "2026-03-05T10:44:10.331623Z"}, {"uuid": "f08775dd-9ca6-46be-8e84-4bedb0b9c225", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28720", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgegnrbzur2e", "content": "", "creation_timestamp": "2026-03-06T04:04:49.086954Z"}, {"uuid": "f844e7f3-812c-4e06-aec5-05b65d5c2d4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28545", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgcmrvnsbo2e", "content": "", "creation_timestamp": "2026-03-05T10:49:10.842733Z"}, {"uuid": "f7f70948-b6b6-450c-864b-350ee910fa7c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28723", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgegrmaz2v24", "content": "", "creation_timestamp": "2026-03-06T04:06:57.989961Z"}, {"uuid": "8ac32734-3937-49cc-a918-f5d86ce7f151", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28213", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfwy4rwxk22h", "content": "", "creation_timestamp": "2026-02-28T19:40:10.546832Z"}, {"uuid": "282edcc7-9db8-41dd-9bf1-227af8529320", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28724", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgegvqn3qz27", "content": "", "creation_timestamp": "2026-03-06T04:09:16.760243Z"}, {"uuid": "539cc820-ce58-41bd-9f26-211d266fe6ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28338", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuttvuhhk2u", "content": "", "creation_timestamp": "2026-02-27T23:18:18.018466Z"}, {"uuid": "3968410e-3374-4311-b9e1-3bd04d54ff98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28501", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgeh27z6d62y", "content": "", "creation_timestamp": "2026-03-06T04:11:47.203148Z"}, {"uuid": "e1ffd9f1-9585-4fdf-b09b-7a7832483144", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28276", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfutx7zcfx2w", "content": "", "creation_timestamp": "2026-02-27T23:20:10.090849Z"}, {"uuid": "3a3f211f-f06c-42ff-95fb-3d80c0903237", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28409", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mg6hc6f32y2e", "content": "", "creation_timestamp": "2026-03-03T19:00:15.883753Z"}, {"uuid": "8a192b0d-8f8c-40ba-93f9-bde79928a3f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28288", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfutximupo2n", "content": "", "creation_timestamp": "2026-02-27T23:20:18.103177Z"}, {"uuid": "366b0348-e186-4cee-9a67-849c2126119a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28722", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgeheidtyd2e", "content": "", "creation_timestamp": "2026-03-06T04:17:31.329809Z"}, {"uuid": "ce0a09df-3b39-496f-85c4-85135c5b34fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28789", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgi74zq7d325", "content": "", "creation_timestamp": "2026-03-07T16:00:51.174378Z"}, {"uuid": "c8457de1-879b-4f91-9bf7-58669c99f546", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28351", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuu3dkef724", "content": "", "creation_timestamp": "2026-02-27T23:22:27.143285Z"}, {"uuid": "1bad6198-846f-4d7b-8ea0-4d4ad9ba6bd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mgcoqqwpj22k", "content": "", "creation_timestamp": "2026-03-05T11:24:24.009325Z"}, {"uuid": "ee45a3de-4d29-4ad8-9eab-044a9de8345f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28727", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgehkhgd4b2n", "content": "", "creation_timestamp": "2026-03-06T04:20:51.682751Z"}, {"uuid": "31db2ae6-1ff4-4f61-b29b-a18d36dc6972", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28721", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgehr6dgpv2d", "content": "", "creation_timestamp": "2026-03-06T04:24:37.083111Z"}, {"uuid": "3d5b3258-80b4-41d7-a92d-fe277df3ed6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28790", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgi75b3eca2s", "content": "", "creation_timestamp": "2026-03-07T16:00:58.782942Z"}, {"uuid": "b8f8ec83-9abb-41f5-8d25-17b5a2d23287", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28400", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuudxdzgn2y", "content": "", "creation_timestamp": "2026-02-27T23:27:16.273496Z"}, {"uuid": "738a7c23-6895-4385-8a20-c4dd12c9afdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28399", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mg6ifbejac2s", "content": "", "creation_timestamp": "2026-03-03T19:19:53.428543Z"}, {"uuid": "59793abf-92ee-4bc8-b022-1748bdab8083", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28391", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mgehy7q6nv2u", "content": "", "creation_timestamp": "2026-03-06T04:28:33.757648Z"}, {"uuid": "456caacb-9bfb-4b7c-9bb7-864b5c566452", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28364", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mghd5r2ljs2m", "content": "", "creation_timestamp": "2026-03-07T07:40:10.051050Z"}, {"uuid": "b7b8f167-02ae-4a3b-9ab0-e7f7864b7df9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28370", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mft53vqscy2e", "content": "", "creation_timestamp": "2026-02-27T06:58:30.713589Z"}, {"uuid": "83862c3e-d1a4-42d5-89ad-9903db3df590", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28268", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuuitqwdg2n", "content": "", "creation_timestamp": "2026-02-27T23:30:00.331810Z"}, {"uuid": "c75e2e0f-313a-464d-9d1c-cbf0db8e3d86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28408", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mg6ifqwhmi2i", "content": "", "creation_timestamp": "2026-03-03T19:20:09.752797Z"}, {"uuid": "fb5e9b33-fc87-41d6-a579-3c6d14472d16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28289", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/116176451374852595", "content": "", "creation_timestamp": "2026-03-05T11:59:25.960743Z"}, {"uuid": "506a99f5-7710-4fc9-b783-2e93f53d9f0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28719", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgehytuzzk2y", "content": "", "creation_timestamp": "2026-03-06T04:28:54.492228Z"}, {"uuid": "52eb81eb-dba5-488e-801f-66c69cd25d55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28425", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mghebo2itw23", "content": "", "creation_timestamp": "2026-03-07T08:00:14.982176Z"}, {"uuid": "7e877ca9-73cd-4e07-ac12-70e76d8ba9ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28678", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mgiaikp4vy2v", "content": "", "creation_timestamp": "2026-03-07T16:25:10.860022Z"}, {"uuid": "3f0af65f-3a10-4898-819d-681131b91a06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mgcqqfext22x", "content": "", "creation_timestamp": "2026-03-05T11:59:56.263509Z"}, {"uuid": "71e619ad-c11d-4cac-bbeb-1bc15283c1eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28392", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mgei2szllz2c", "content": "", "creation_timestamp": "2026-03-06T04:30:01.640491Z"}, {"uuid": "b1fd24d1-b693-4c02-a801-7b8f4f0010cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28355", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuuo7pufx2y", "content": "", "creation_timestamp": "2026-02-27T23:33:00.639471Z"}, {"uuid": "97439adf-7fa0-4ddf-a1b3-ddfcc8afefbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28372", "type": "seen", "source": "https://gist.github.com/alon710/e03d04f1cd72c0b9caeca59fc12c90ff", "content": "", "creation_timestamp": "2026-03-02T07:10:32.000000Z"}, {"uuid": "c03e2595-35a0-4c07-ba34-9012f79d8bf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28403", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgcqqzd2ay2m", "content": "", "creation_timestamp": "2026-03-05T12:00:16.544166Z"}, {"uuid": "0e40715f-1a1e-4124-886f-2abb6e10f264", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28501", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116180348415123960", "content": "", "creation_timestamp": "2026-03-06T04:30:31.464416Z"}, {"uuid": "f5089a94-9b1b-482b-986a-c2b6d9b66ef1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28697", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgcqrifnfy2c", "content": "", "creation_timestamp": "2026-03-05T12:00:32.391322Z"}, {"uuid": "97995a7d-470d-4a9e-ab84-a3a720b00c4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28501", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mgei3qomue2p", "content": "", "creation_timestamp": "2026-03-06T04:30:32.379811Z"}, {"uuid": "9cd71218-f474-40fd-b33e-5fbd1c0d1c43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28274", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mft5avgvia2f", "content": "", "creation_timestamp": "2026-02-27T07:01:19.064293Z"}, {"uuid": "0157fcd4-8fc6-427a-bf40-76ffb6903459", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28402", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuuu6sb7a2v", "content": "", "creation_timestamp": "2026-02-27T23:36:20.993625Z"}, {"uuid": "ff383527-0906-459b-b135-729ba9b58b32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28554", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfxfyuoldd2o", "content": "", "creation_timestamp": "2026-02-28T23:48:31.458255Z"}, {"uuid": "7318c831-2a2f-4c87-81ea-62f7f5a25232", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28474", "type": "seen", "source": "https://bsky.app/profile/yazoul-alerts.bsky.social/post/3mgidaqepjh2g", "content": "", "creation_timestamp": "2026-03-07T17:14:29.467920Z"}, {"uuid": "f1ae2234-3b22-48f8-8bbf-a8e2dafb9fef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28275", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mft5b53xqh2x", "content": "", "creation_timestamp": "2026-02-27T07:01:28.664363Z"}, {"uuid": "cda65fdd-6b9b-4476-a412-6865d0894f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28557", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfxg6aocx224", "content": "", "creation_timestamp": "2026-02-28T23:51:31.760475Z"}, {"uuid": "acf0da41-a984-46fa-80b6-d9523b942911", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28276", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mft5bgfs4b2n", "content": "", "creation_timestamp": "2026-02-27T07:01:36.368934Z"}, {"uuid": "44e76a71-fe59-400d-82b5-d74334d2620a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28562", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfxge7qf2o2z", "content": "", "creation_timestamp": "2026-02-28T23:54:52.665217Z"}, {"uuid": "19f76279-d377-4bf0-8e39-b81fec6ec189", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28501", "type": "seen", "source": "https://bsky.app/profile/blueskymoodreport.bsky.social/post/3mgeiabc5bl2n", "content": "", "creation_timestamp": "2026-03-06T04:33:04.033107Z"}, {"uuid": "d43e361a-f474-4900-9726-01746cb24985", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28216", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mft5epkqll26", "content": "", "creation_timestamp": "2026-02-27T07:03:27.526978Z"}, {"uuid": "8570ac5f-068a-48d2-89db-a5bfd0bfb8c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28558", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfxgkwmlrp2d", "content": "", "creation_timestamp": "2026-02-28T23:58:37.445662Z"}, {"uuid": "bf370e3c-ae27-40fd-acb2-f379566b8344", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28726", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgeibsbxsh2o", "content": "", "creation_timestamp": "2026-03-06T04:33:54.780312Z"}, {"uuid": "58dc0098-be84-4a3a-9b40-28a270dedf47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28231", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuvclbl6n2e", "content": "", "creation_timestamp": "2026-02-27T23:44:23.959227Z"}, {"uuid": "c85d6230-ef2f-4d33-a0c8-a2f669ed4f21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28211", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mft5ey7out2s", "content": "", "creation_timestamp": "2026-02-27T07:03:35.660280Z"}, {"uuid": "6d6bd907-6a0a-4dae-af72-83bae4b758ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28272", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuvljoruf2d", "content": "", "creation_timestamp": "2026-02-27T23:49:24.248472Z"}, {"uuid": "dacb4e78-308b-4ce7-8432-187d8fd78359", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2896", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mfgcqlespt2b", "content": "", "creation_timestamp": "2026-02-22T04:34:56.420846Z"}, {"uuid": "4861b048-c0a4-49c8-8eaa-40e784497574", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28213", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mft5fap4ob2n", "content": "", "creation_timestamp": "2026-02-27T07:03:44.455361Z"}, {"uuid": "99e51dd3-b381-4c26-94d7-34a2863340e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28270", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuvui4ay42z", "content": "", "creation_timestamp": "2026-02-27T23:54:24.504565Z"}, {"uuid": "fb920dc6-3faf-4884-bbae-fa62ab34abe7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2835", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgbibcch662u", "content": "", "creation_timestamp": "2026-03-04T23:55:38.880882Z"}, {"uuid": "cde5160e-c321-460b-9797-a0481973137c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2853", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfcyvdcvl72c", "content": "", "creation_timestamp": "2026-02-20T21:00:39.498407Z"}, {"uuid": "f8fb8663-5069-4323-bc74-d3f6edf6416f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28354", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuw5gjdhe2e", "content": "", "creation_timestamp": "2026-02-27T23:59:24.962192Z"}, {"uuid": "3023c5ec-30e8-4456-8e36-5fb894f82a06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28559", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfxgsm75am2y", "content": "", "creation_timestamp": "2026-03-01T00:02:54.931901Z"}, {"uuid": "291db3f8-8155-4f06-8d0d-37ffc24c1666", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2833", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgbienwabx2v", "content": "", "creation_timestamp": "2026-03-04T23:57:31.711730Z"}, {"uuid": "93c9420b-776f-4063-9e22-55ca58bf52dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2854", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfcyvkr2nc2k", "content": "", "creation_timestamp": "2026-02-20T21:00:47.042691Z"}, {"uuid": "72db765c-e196-4fdf-8c88-7c09a69fa1a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28215", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mft6ehnjqv2c", "content": "", "creation_timestamp": "2026-02-27T07:21:11.746019Z"}, {"uuid": "cbfa8535-0bd9-4e6a-8f52-2bdf19aabf86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2854", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfcyx4c4wj2n", "content": "", "creation_timestamp": "2026-02-20T21:01:39.227082Z"}, {"uuid": "f0398e22-7e6a-4c1c-b74e-2eed4d9a5dbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28411", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116145313710936969", "content": "", "creation_timestamp": "2026-02-28T00:00:43.540582Z"}, {"uuid": "8209a69f-e60c-48c8-872c-11bb8ef0a873", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-2835", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116173625220062897", "content": "", "creation_timestamp": "2026-03-05T00:00:42.792765Z"}, {"uuid": "95aa4549-eb14-4bcd-98d8-4b9cc99ad876", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2855", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfcyxdmzvk2k", "content": "", "creation_timestamp": "2026-02-20T21:01:47.215525Z"}, {"uuid": "3954238b-ebf1-4303-8fb2-776e675f3d87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28411", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mfuw7sp34d2h", "content": "", "creation_timestamp": "2026-02-28T00:00:45.107591Z"}, {"uuid": "b567ce08-94d6-44e5-a719-b21bddade7d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-2835", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mgbikfuvoc2u", "content": "", "creation_timestamp": "2026-03-05T00:00:48.414220Z"}, {"uuid": "2b6408f2-962c-4aa1-9112-171d8bb7dce4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28352", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuwgeww3c2o", "content": "", "creation_timestamp": "2026-02-28T00:04:25.253642Z"}, {"uuid": "301fdd2d-6e4b-482b-9785-4976fab98855", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28556", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfxh3kmvjv2v", "content": "", "creation_timestamp": "2026-03-01T00:07:55.244305Z"}, {"uuid": "9b04aecc-2ce1-4262-a5ec-adc14c88a2ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28370", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mft6v5zw4o2h", "content": "", "creation_timestamp": "2026-02-27T07:30:33.037226Z"}, {"uuid": "64b9eaa4-99a1-4043-8c68-47aabfe5d6b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28561", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfxhej34ew27", "content": "", "creation_timestamp": "2026-03-01T00:12:55.761080Z"}, {"uuid": "2c1e3c5d-a022-47cf-900f-32817af25e51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28271", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuwpdeu522u", "content": "", "creation_timestamp": "2026-02-28T00:09:25.488857Z"}, {"uuid": "2f130f59-8481-4caf-af92-99552e2792dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28508", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgemmi7vhp24", "content": "", "creation_timestamp": "2026-03-06T05:51:28.376937Z"}, {"uuid": "516281ca-89cb-4454-a85d-29b32ecde202", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28560", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfxhwfwl2w2o", "content": "", "creation_timestamp": "2026-03-01T00:22:56.337420Z"}, {"uuid": "09dc222c-3bfb-4ebe-956c-ce01ce568a60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28507", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgemyxfnxq2e", "content": "", "creation_timestamp": "2026-03-06T05:58:27.027434Z"}, {"uuid": "f8ed7ca9-ee38-45ff-a845-41a54e76c0c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28794", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116180702140239593", "content": "", "creation_timestamp": "2026-03-06T06:00:27.973490Z"}, {"uuid": "a6655527-bfd3-4bae-a775-c7e05799c22e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28794", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mgen4m3k2s25", "content": "", "creation_timestamp": "2026-03-06T06:00:29.928441Z"}, {"uuid": "852c2500-746c-49d8-b4c5-c07426c2c132", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28777", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg7zrs6vo22o", "content": "", "creation_timestamp": "2026-03-04T10:03:46.916146Z"}, {"uuid": "d90e4a5b-c3ba-42d9-bd3c-a0091d53d77c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28677", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgen5tucif2x", "content": "", "creation_timestamp": "2026-03-06T06:01:10.889877Z"}, {"uuid": "26162542-9e97-4c1a-bae3-3ee3d0b4bced", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mgcxe5mgq62p", "content": "", "creation_timestamp": "2026-03-05T13:58:21.174867Z"}, {"uuid": "f48787d8-79ad-4bb7-82dd-901f27bd78c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28681", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgend7unkc2k", "content": "", "creation_timestamp": "2026-03-06T06:04:11.343889Z"}, {"uuid": "f2c36dc0-39fd-4440-9b73-01f33205ff2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28136", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mftavmi2ph2x", "content": "", "creation_timestamp": "2026-02-27T08:06:35.183023Z"}, {"uuid": "cc98cc6e-8123-4a84-864a-ef3b0dc9af79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28680", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgenj6wcpm2y", "content": "", "creation_timestamp": "2026-03-06T06:07:32.012013Z"}, {"uuid": "e5ebd58b-8133-4580-a429-476eb8a1e2ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28426", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuz5v32k32e", "content": "", "creation_timestamp": "2026-02-28T00:53:21.455843Z"}, {"uuid": "6b8f7868-c2db-40b4-834f-9616d6f94796", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28409", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuzcrimck2u", "content": "", "creation_timestamp": "2026-02-28T00:56:07.335327Z"}, {"uuid": "ad401472-8873-4090-89ef-f2033224a096", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28416", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgcxhleidf2a", "content": "", "creation_timestamp": "2026-03-05T14:00:16.000766Z"}, {"uuid": "890c0a8a-04bc-44c5-8a19-8e45912af82f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28679", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgenpvtoos27", "content": "", "creation_timestamp": "2026-03-06T06:11:17.161275Z"}, {"uuid": "8ef7d4b3-ab8b-4aa7-904c-b75b3d77e5c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28516", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuzi6em5h2o", "content": "", "creation_timestamp": "2026-02-28T00:59:06.764930Z"}, {"uuid": "88a19759-f99f-42bf-987d-59fb49a5eb6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28555", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfxi7edqhp2k", "content": "", "creation_timestamp": "2026-03-01T00:27:57.053828Z"}, {"uuid": "61e20e35-b010-401c-b4d7-009a0c9402bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28676", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgeoajsm3l27", "content": "", "creation_timestamp": "2026-03-06T06:20:35.096721Z"}, {"uuid": "4ab99425-85d7-42bd-9941-f621ef435756", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28406", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuzo5gqth2e", "content": "", "creation_timestamp": "2026-02-28T01:02:26.958136Z"}, {"uuid": "8d4e9ad2-8158-45cc-ad96-f599c66e99a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28794", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgeoji7vhc2d", "content": "", "creation_timestamp": "2026-03-06T06:25:35.360394Z"}, {"uuid": "45ba4f79-0950-4816-8265-1000b8782ee3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28411", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfuzuudvhy2v", "content": "", "creation_timestamp": "2026-02-28T01:06:12.309874Z"}, {"uuid": "b85eae60-ce4e-4055-a19b-37bd83e931d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28683", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgeosgmxfl2u", "content": "", "creation_timestamp": "2026-03-06T06:30:35.610244Z"}, {"uuid": "d52f6e7f-dd8b-4ac5-9583-af538a39bc3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2854", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfmc5ejx732e", "content": "", "creation_timestamp": "2026-02-24T13:40:10.311041Z"}, {"uuid": "597803d3-6c43-4f93-aa63-5a6d18c0162b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28785", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgep3f2i5w2u", "content": "", "creation_timestamp": "2026-03-06T06:35:36.164527Z"}, {"uuid": "429191e6-9ffc-4c26-8e29-b50c9683a9fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28416", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfv2ficwc72o", "content": "", "creation_timestamp": "2026-02-28T01:15:30.088040Z"}, {"uuid": "147820a1-eb2d-4562-8360-fcaae1095734", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28787", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgepedhs6y2v", "content": "", "creation_timestamp": "2026-03-06T06:40:36.352762Z"}, {"uuid": "eb4be1a8-a687-4170-95be-a05acd38c55f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28425", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfv2oh5wcv2x", "content": "", "creation_timestamp": "2026-02-28T01:20:30.891296Z"}, {"uuid": "ad2b95ed-89ba-49c2-8077-49735dd0cdec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28517", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfv2xflkle2z", "content": "", "creation_timestamp": "2026-02-28T01:25:31.512394Z"}, {"uuid": "038f9bd0-bbc9-4c3d-84d8-093ae1d4e67d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28409", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116145666777961188", "content": "", "creation_timestamp": "2026-02-28T01:30:31.054713Z"}, {"uuid": "7f311f2c-a513-405f-be05-81793330baeb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-2844", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116151328926962047", "content": "", "creation_timestamp": "2026-03-01T01:30:29.197097Z"}, {"uuid": "4c4c4002-428d-410c-9f44-58e74feba8bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28515", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfv3adzuum27", "content": "", "creation_timestamp": "2026-02-28T01:30:31.639757Z"}, {"uuid": "efe65f27-36bb-4d39-a173-17b45687ae2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-2844", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mfxlp7kzxd22", "content": "", "creation_timestamp": "2026-03-01T01:30:30.982227Z"}, {"uuid": "e131cfa1-66fb-4192-999f-039c40434afd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28409", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mfv3aeriki2u", "content": "", "creation_timestamp": "2026-02-28T01:30:32.922172Z"}, {"uuid": "96df9eac-faed-4651-a524-02e39d4372e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28425", "type": "seen", "source": "https://gist.github.com/alon710/6dff5aa5b78da9632648e4342c5b33c1", "content": "", "creation_timestamp": "2026-03-01T01:40:21.000000Z"}, {"uuid": "3b44851c-4acb-41ba-b6c2-35bfdca45943", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28408", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfv3jchrya2u", "content": "", "creation_timestamp": "2026-02-28T01:35:32.159978Z"}, {"uuid": "c39ce458-3918-4ff1-95e1-7f6718f01141", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-2833", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116173978081466559", "content": "", "creation_timestamp": "2026-03-05T01:30:27.698952Z"}, {"uuid": "81c3e9c0-5946-44b9-95e1-3b77536e5427", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28292", "type": "seen", "source": "https://gist.github.com/alon710/55440ca983eb1e00bbb022804644523d", "content": "", "creation_timestamp": "2026-03-10T20:10:05.000000Z"}, {"uuid": "1fd8f580-952e-49a2-a90a-f11f16556bf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-2833", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mgbnku3z3t2u", "content": "", "creation_timestamp": "2026-03-05T01:30:28.761971Z"}, {"uuid": "b3b74f5f-e06d-4a28-a737-531afe364d04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28193", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfrpelcdnh2w", "content": "", "creation_timestamp": "2026-02-26T17:20:09.609873Z"}, {"uuid": "47adcd19-6727-49f2-a0d7-efa94905a2cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2870", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mg3ewv4gch2u", "content": "", "creation_timestamp": "2026-03-02T13:40:10.388595Z"}, {"uuid": "ac9d035b-1509-4a9f-8930-c6fbbf5fd6e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://threatintel.cc/2026/03/05/065931.html", "content": "", "creation_timestamp": "2026-03-05T10:59:31.000000Z"}, {"uuid": "eddb90dd-6cdd-40eb-8f44-0273b49f2f4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28295", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mfxngxsn262c", "content": "", "creation_timestamp": "2026-03-01T02:01:40.904695Z"}, {"uuid": "1a234388-5ae9-4c2b-a669-a120397a0284", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28296", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mfxngxsn262c", "content": "", "creation_timestamp": "2026-03-01T02:01:40.991893Z"}, {"uuid": "03850999-d338-4ab2-8c4c-397378f373a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2836", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgbp6ahfzk2v", "content": "", "creation_timestamp": "2026-03-05T01:59:13.127914Z"}, {"uuid": "88f5cd6e-293a-4162-aeef-7597f9f33171", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28799", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgetcdbnqw2z", "content": "", "creation_timestamp": "2026-03-06T07:51:06.930256Z"}, {"uuid": "ff7a809b-3995-43fd-8337-6c02604e5655", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28426", "type": "seen", "source": "https://gist.github.com/alon710/74dba3e5da70d59374d9df1bc83c463e", "content": "", "creation_timestamp": "2026-03-01T02:10:22.000000Z"}, {"uuid": "ec81ad9e-1b73-4d0b-b5de-6e3739d87b18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28438", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgetfa2pvw2n", "content": "", "creation_timestamp": "2026-03-06T07:52:41.244506Z"}, {"uuid": "07acddb4-3f21-4bd4-a717-17b5d681da01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28426", "type": "seen", "source": "https://bsky.app/profile/flarestart.bsky.social/post/3mfxorpajt22s", "content": "", "creation_timestamp": "2026-03-01T02:25:34.767990Z"}, {"uuid": "74fcae2d-ff55-4dad-9225-f775c8e9afa6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28801", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgetor37ty2n", "content": "", "creation_timestamp": "2026-03-06T07:58:00.993508Z"}, {"uuid": "e8c34ec1-181f-4b89-8c88-f1fa117730e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28804", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgetsdviem2u", "content": "", "creation_timestamp": "2026-03-06T08:00:01.374835Z"}, {"uuid": "aa94ea7a-228c-4c1a-8eb5-85093b29a819", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2856", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfdedtayjy26", "content": "", "creation_timestamp": "2026-02-21T00:25:38.055977Z"}, {"uuid": "3a096598-0db5-49e7-841c-42fea56655e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2857", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfdee2ewla2h", "content": "", "creation_timestamp": "2026-02-21T00:25:44.434046Z"}, {"uuid": "5b126e55-588d-41d1-b7bc-3989df9c141e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28426", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mfxpiwzeldm2", "content": "", "creation_timestamp": "2026-03-01T02:38:35.881358Z"}, {"uuid": "54749f4b-c6e2-4812-8379-98bd993d04ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28424", "type": "seen", "source": "https://gist.github.com/alon710/99efb0d74d514062b9d54ac7af70acf9", "content": "", "creation_timestamp": "2026-03-01T02:40:22.000000Z"}, {"uuid": "af6bc97e-cd99-436c-bece-e1ed7c87c416", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28795", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgetw6u4a22n", "content": "", "creation_timestamp": "2026-03-06T08:02:10.317352Z"}, {"uuid": "8fcff005-f88f-43ee-80a9-5cbf7aa14c48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28372", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mgfovngctd2h", "content": "", "creation_timestamp": "2026-03-06T16:05:07.044085Z"}, {"uuid": "bb009490-add1-4f35-8efd-62bc1982a322", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2846", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfmm7a2lxm2m", "content": "", "creation_timestamp": "2026-02-24T16:40:10.419170Z"}, {"uuid": "32ad37ff-58cb-4624-abda-9c2c39ebbe97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28787", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeu674gzi2c", "content": "", "creation_timestamp": "2026-03-06T08:06:40.261478Z"}, {"uuid": "696ea70b-f9a6-44df-827f-c414ab892b1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2847", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfmnd5r24u2w", "content": "", "creation_timestamp": "2026-02-24T17:00:15.549068Z"}, {"uuid": "76d1cb3d-03d3-4f81-839a-2df4a2b55d08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28683", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeu6hj3tj26", "content": "", "creation_timestamp": "2026-03-06T08:06:48.859711Z"}, {"uuid": "23da123d-1277-450d-a942-b9e27aeea657", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28680", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeu6oysy32h", "content": "", "creation_timestamp": "2026-03-06T08:06:56.729774Z"}, {"uuid": "7f7e75e8-080d-4c7f-8efa-6c900c2a4fd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28681", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeu6w36ns2f", "content": "", "creation_timestamp": "2026-03-06T08:07:03.950338Z"}, {"uuid": "ea17f4c2-eeeb-44ae-9b20-ce2b60b74f17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28676", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeu75lg5x2c", "content": "", "creation_timestamp": "2026-03-06T08:07:12.518817Z"}, {"uuid": "fc5a5705-bc01-4797-b716-d9e7dc088d70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28677", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeu7famc32v", "content": "", "creation_timestamp": "2026-03-06T08:07:19.956867Z"}, {"uuid": "e5f6f4f2-27bd-4b18-aeed-34ea9705bc68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28295", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfrvyhqmyl2d", "content": "", "creation_timestamp": "2026-02-26T19:18:39.244115Z"}, {"uuid": "9f5215a0-b72a-43a9-99f4-86640b156b3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28787", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeu7h634l2h", "content": "", "creation_timestamp": "2026-03-06T08:07:22.320533Z"}, {"uuid": "8e402147-1618-4f1c-a8ae-8b7d3a8d660e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28683", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeu7pnllt2h", "content": "", "creation_timestamp": "2026-03-06T08:07:30.679453Z"}, {"uuid": "04f79c5f-a3fb-446b-a2b5-59329613dca3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28268", "type": "seen", "source": "https://bsky.app/profile/cyberlensai.bsky.social/post/3mfxqtr3fot2f", "content": "", "creation_timestamp": "2026-03-01T03:02:34.369888Z"}, {"uuid": "8b165119-bc1a-491d-881f-5de82b7b0200", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28680", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeu7yhke32n", "content": "", "creation_timestamp": "2026-03-06T08:07:40.119473Z"}, {"uuid": "6a6a7639-43df-4c89-b700-5364f7753508", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2865", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfqevltij32w", "content": "", "creation_timestamp": "2026-02-26T04:40:10.242509Z"}, {"uuid": "3921c7a1-9b59-4347-9f1d-5f27db1c5b28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28423", "type": "seen", "source": "https://gist.github.com/alon710/50bb89929f5a073708371f4c768a5227", "content": "", "creation_timestamp": "2026-03-01T03:10:21.000000Z"}, {"uuid": "5d6c7c5e-8877-4d07-a2fb-3899fa787361", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28681", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeud4fori2s", "content": "", "creation_timestamp": "2026-03-06T08:09:25.057862Z"}, {"uuid": "51eb286b-76ff-4f94-a66f-ddb4e12b4837", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mgewqdnkp223", "content": "", "creation_timestamp": "2026-03-06T08:52:35.690845Z"}, {"uuid": "c9012a62-cdaa-45f8-916c-97004cc10abe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28676", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeudekl2c2f", "content": "", "creation_timestamp": "2026-03-06T08:09:33.575417Z"}, {"uuid": "e99f3509-ed29-4f4f-aa1b-089b4b316844", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2848", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfdmye2vpj2m", "content": "", "creation_timestamp": "2026-02-21T03:00:15.444784Z"}, {"uuid": "79876a94-b4d0-493d-aa67-c9b0a00b115d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28677", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeudmo5ri2c", "content": "", "creation_timestamp": "2026-03-06T08:09:42.378218Z"}, {"uuid": "e3bb8439-a1ad-4799-a11f-f89cfeced83e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28800", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgeudp2gzj2o", "content": "", "creation_timestamp": "2026-03-06T08:09:43.382512Z"}, {"uuid": "96bc981f-a0c0-45bd-91b7-2551be8f53ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28426", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgd2sv42sw2a", "content": "", "creation_timestamp": "2026-03-05T15:00:16.831735Z"}, {"uuid": "4fd925fd-19e2-48f0-84a9-14f64c335909", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28679", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeudrl2nt2h", "content": "", "creation_timestamp": "2026-03-06T08:09:47.080302Z"}, {"uuid": "78d65b00-4067-4c9b-88f3-f828496a6cac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28280", "type": "seen", "source": "https://gist.github.com/alon710/b64eb8bf5447813639656d54741fea24", "content": "", "creation_timestamp": "2026-02-28T02:40:11.000000Z"}, {"uuid": "7e1bf34a-a8cf-4e35-b2c6-c801ed1d3c50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28429", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeudz4b5z26", "content": "", "creation_timestamp": "2026-03-06T08:09:55.081029Z"}, {"uuid": "2521bd6a-2ffa-48e8-afdd-4d48d1f7310f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28681", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeue6ghug25", "content": "", "creation_timestamp": "2026-03-06T08:10:00.765606Z"}, {"uuid": "6a4852e1-e82b-4eee-a48d-0bc87f509bbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28280", "type": "seen", "source": "https://bsky.app/profile/flarestart.bsky.social/post/3mfv7xisgyv2b", "content": "", "creation_timestamp": "2026-02-28T02:55:04.342646Z"}, {"uuid": "781cee1f-1c0e-4f05-8d7e-0ad50bfb95a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28416", "type": "seen", "source": "https://gist.github.com/alon710/9f993a06ed7bab9401f4ef1661c6ed1f", "content": "", "creation_timestamp": "2026-03-01T03:40:22.000000Z"}, {"uuid": "e75f993a-fb2d-41c2-bc50-c05a9fa2195a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28372", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mg3nuyvnko2h", "content": "", "creation_timestamp": "2026-03-02T16:20:10.721242Z"}, {"uuid": "0aa7e7df-8947-4c94-bebb-71a8bfbf8178", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28400", "type": "seen", "source": "http://www.zerodayinitiative.com/advisories/ZDI-26-150/", "content": "", "creation_timestamp": "2026-03-03T05:00:00.000000Z"}, {"uuid": "fedcc472-6f6c-40a4-a8c7-c4f8182f08a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28676", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeueggill2d", "content": "", "creation_timestamp": "2026-03-06T08:10:08.968875Z"}, {"uuid": "618000ce-120c-4d39-9377-b266f268573e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28408", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116146020481643691", "content": "", "creation_timestamp": "2026-02-28T03:00:28.073934Z"}, {"uuid": "80a3c296-d6ea-4ca0-b088-69ce057680fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28134", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgd3s6jakd2x", "content": "", "creation_timestamp": "2026-03-05T15:17:47.143215Z"}, {"uuid": "036436a3-0ca3-4f26-9c9e-a27afc3527ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28677", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeueosyfh2c", "content": "", "creation_timestamp": "2026-03-06T08:10:17.660994Z"}, {"uuid": "62dcb029-70e3-4614-b116-f02797fc736c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28408", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mfvab7gtmx2n", "content": "", "creation_timestamp": "2026-02-28T03:00:29.684118Z"}, {"uuid": "0927de50-2340-4381-ba73-74a4f3769071", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28123", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgd3sfwavo2c", "content": "", "creation_timestamp": "2026-03-05T15:17:54.424702Z"}, {"uuid": "bf361b5c-ab1d-47dc-b675-1fd99dec6b70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28681", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeufawcti2s", "content": "", "creation_timestamp": "2026-03-06T08:10:37.046033Z"}, {"uuid": "1e43c7b9-3a32-460a-af25-ff174cab57c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28403", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3ocylao62v", "content": "", "creation_timestamp": "2026-03-02T16:28:00.469026Z"}, {"uuid": "523032c1-8ab8-477c-9b81-31af5bea5378", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28125", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgd3sn4ttn2d", "content": "", "creation_timestamp": "2026-03-05T15:18:01.642611Z"}, {"uuid": "34c51bc7-e22d-4753-8414-e823820e7376", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28681", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mgeufckq6d2q", "content": "", "creation_timestamp": "2026-03-06T08:10:37.794194Z"}, {"uuid": "a254c2d1-d2a5-4b79-a5dc-44581193c7ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28296", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfrxdkoeor2z", "content": "", "creation_timestamp": "2026-02-26T19:42:45.170774Z"}, {"uuid": "198d0b13-fa76-4c3b-b088-d27f52fdf89b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28415", "type": "seen", "source": "https://gist.github.com/alon710/794157ac4402be5b97d405f38441e2cb", "content": "", "creation_timestamp": "2026-03-01T04:10:22.000000Z"}, {"uuid": "1b69926a-15b6-428a-b8c3-e18dcfd7c0f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28676", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeufjib4t2s", "content": "", "creation_timestamp": "2026-03-06T08:10:45.667712Z"}, {"uuid": "2f5148c0-ba1d-489f-b7ce-4ce489acc80d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28415", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mfxvi7zur4c2", "content": "", "creation_timestamp": "2026-03-01T04:25:33.355774Z"}, {"uuid": "1db92412-cec8-4cde-afb0-9142000d8212", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28677", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeufrp3yl2n", "content": "", "creation_timestamp": "2026-03-06T08:10:54.362148Z"}, {"uuid": "9bdf6092-e69e-4225-b597-73c960260840", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28562", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfxvjvfkpq2t", "content": "", "creation_timestamp": "2026-03-01T04:26:29.439808Z"}, {"uuid": "8633ac1f-8cd8-43a6-9f8c-a648923a99de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28414", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgd5275cql2r", "content": "", "creation_timestamp": "2026-03-05T15:40:09.353370Z"}, {"uuid": "afa8bf4d-927b-4e0b-a5d5-931f3cddc053", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28501", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeunkgbe32n", "content": "", "creation_timestamp": "2026-03-06T08:15:14.986819Z"}, {"uuid": "cd5908c9-830b-4152-adc3-e6f4c32bfa46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2896", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfmrs2dnbe2a", "content": "", "creation_timestamp": "2026-02-24T18:20:10.275180Z"}, {"uuid": "60aedb7c-afdc-4078-b5ff-7bfd93338c1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28562", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfxvkozhwy2s", "content": "", "creation_timestamp": "2026-03-01T04:26:56.768069Z"}, {"uuid": "8f622d98-2932-4620-b3b7-897ddd4e5a6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28501", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgeuojcgv226", "content": "", "creation_timestamp": "2026-03-06T08:15:47.977981Z"}, {"uuid": "44391c2e-ad1e-40f4-a668-c94f940f5c9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28514", "type": "seen", "source": "https://infosec.exchange/users/harrysintonen/statuses/116207403212934287", "content": "", "creation_timestamp": "2026-03-10T23:10:58.187970Z"}, {"uuid": "c115c19a-aed3-469b-b74c-eb01fd4e274a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28289", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mgd64d3sif2s", "content": "", "creation_timestamp": "2026-03-05T15:59:14.144401Z"}, {"uuid": "d1fd15d5-d02a-4dca-81ea-0a292fe7443a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28407", "type": "seen", "source": "https://gist.github.com/alon710/43a4ce973e7deb9cb22c759bda6c4252", "content": "", "creation_timestamp": "2026-02-28T03:40:10.000000Z"}, {"uuid": "bf5f8b26-edf8-41ec-93b9-ee0c6e655684", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28415", "type": "seen", "source": "https://bsky.app/profile/flarestart.bsky.social/post/3mfxvpebohq2q", "content": "", "creation_timestamp": "2026-03-01T04:29:32.362860Z"}, {"uuid": "94355fbc-fb7d-4f6a-b6c2-536282b6124b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28286", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgd665u2qq2m", "content": "", "creation_timestamp": "2026-03-05T16:00:15.900840Z"}, {"uuid": "7248067e-6395-4510-908d-bb791870f5fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28128", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgd67n7con2s", "content": "", "creation_timestamp": "2026-03-05T16:01:05.864566Z"}, {"uuid": "619d67a4-eb8c-4d06-b588-0701a325c645", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28802", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgeuvsntg22e", "content": "", "creation_timestamp": "2026-03-06T08:19:51.415644Z"}, {"uuid": "c7407bb0-7e56-4168-852b-51e11b570acd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28338", "type": "seen", "source": "https://gist.github.com/alon710/736755cc2599ea9d371fb4c02f1fbf3b", "content": "", "creation_timestamp": "2026-02-28T04:10:10.000000Z"}, {"uuid": "54bee35f-6053-49b7-9de2-d250661bd8dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28129", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgd67uuocd2s", "content": "", "creation_timestamp": "2026-03-05T16:01:14.009715Z"}, {"uuid": "2826ec6f-2063-4388-a7e3-ee475fc326aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28286", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mg3r7vqrqq26", "content": "", "creation_timestamp": "2026-03-02T17:19:58.317928Z"}, {"uuid": "b24814d3-1d00-401a-9f17-f927cbf65979", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28121", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgd6a3omhk2x", "content": "", "creation_timestamp": "2026-03-05T16:01:21.008707Z"}, {"uuid": "1ea7d57d-60fb-4079-9062-628682c6e2b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28425", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfvf2qavsk2s", "content": "", "creation_timestamp": "2026-02-28T04:26:21.889461Z"}, {"uuid": "ecba3920-1399-4848-b649-131de5203b58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28414", "type": "seen", "source": "https://gist.github.com/alon710/c8483d13f0f8c89e0ba6e40695da8060", "content": "", "creation_timestamp": "2026-03-01T04:40:21.000000Z"}, {"uuid": "c13762ea-188f-4fc2-a0f8-fd33bca04a5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28426", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfvf2xw6ub2u", "content": "", "creation_timestamp": "2026-02-28T04:26:30.181166Z"}, {"uuid": "9066797f-8514-4eb8-97d5-6c688fac4f66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28409", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfvf3agkay26", "content": "", "creation_timestamp": "2026-02-28T04:26:37.974300Z"}, {"uuid": "1d85c395-6318-4911-9a4c-7dafdde221e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28806", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116207599051092008", "content": "", "creation_timestamp": "2026-03-11T00:00:43.207559Z"}, {"uuid": "8d6953da-a291-4be9-9f42-67c852069bbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28268", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116146374407182275", "content": "", "creation_timestamp": "2026-02-28T04:30:28.139301Z"}, {"uuid": "14c84b3e-df36-40b2-b021-27afd4b31f72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28124", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgd7jn3yol2x", "content": "", "creation_timestamp": "2026-03-05T16:24:35.190525Z"}, {"uuid": "9e764c0f-8f4f-4a50-b2ea-e35c31003393", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28470", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116183744255692865", "content": "", "creation_timestamp": "2026-03-06T18:54:06.443747Z"}, {"uuid": "777206b1-bfe3-462d-b97b-f376046a60b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28268", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mfvfc5tdfy2o", "content": "", "creation_timestamp": "2026-02-28T04:30:30.409823Z"}, {"uuid": "efea7653-69dc-4137-97ef-13b98c0cd374", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28117", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgd7jubupv26", "content": "", "creation_timestamp": "2026-03-05T16:24:43.051978Z"}, {"uuid": "eb71ecb4-affc-4e1b-9d96-2d3219036a75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28406", "type": "seen", "source": "https://gist.github.com/alon710/7a893e251a88058a62af629d6e1695c0", "content": "", "creation_timestamp": "2026-03-01T05:40:22.000000Z"}, {"uuid": "34d4726a-a113-49ac-a98b-efd00ca6bfe5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28119", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgd7k3epw32x", "content": "", "creation_timestamp": "2026-03-05T16:24:49.561669Z"}, {"uuid": "ad1a8ea5-e9fa-4bfb-a3cb-da2d616f069b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28411", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfvgzf3lou2t", "content": "", "creation_timestamp": "2026-02-28T05:01:23.626693Z"}, {"uuid": "d3b96195-6f8c-4772-9ba3-bbdc5cde1101", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2899", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgc4qdcoqi2o", "content": "", "creation_timestamp": "2026-03-05T06:01:58.554807Z"}, {"uuid": "3788a697-ddbe-4307-aaca-e2ecf7126e16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28414", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfvgzljulm2s", "content": "", "creation_timestamp": "2026-02-28T05:01:30.195045Z"}, {"uuid": "fe5da809-dbb9-4d73-9ee2-9d87f7dd5e05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28416", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfvgzsx5262d", "content": "", "creation_timestamp": "2026-02-28T05:01:38.083887Z"}, {"uuid": "1cad365a-3361-414e-bfae-91bd8b85408d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28400", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfvhu5pqlq2v", "content": "", "creation_timestamp": "2026-02-28T05:16:21.811345Z"}, {"uuid": "64903f91-e1fd-44fb-a00c-dcf746011c87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28406", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfvhuflshb2c", "content": "", "creation_timestamp": "2026-02-28T05:16:30.055242Z"}, {"uuid": "613a54d2-6de9-4ece-a0f6-f0a8cb0a847e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28408", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfvhuo42ej2c", "content": "", "creation_timestamp": "2026-02-28T05:16:39.218277Z"}, {"uuid": "538dd6e3-adeb-4e1b-8ad7-df69c2763111", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28727", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgev5yqsj42f", "content": "", "creation_timestamp": "2026-03-06T08:24:26.497131Z"}, {"uuid": "0d11c527-68f3-4161-97aa-ac7a46c77bc3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28352", "type": "seen", "source": "https://gist.github.com/alon710/32c93832091cb9e283a822174ded1b9e", "content": "", "creation_timestamp": "2026-03-01T06:40:22.000000Z"}, {"uuid": "e46b3189-5358-4548-a31b-9b7ea257a3c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28268", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfvjukgzzm26", "content": "", "creation_timestamp": "2026-02-28T05:52:22.233006Z"}, {"uuid": "de95b94b-3981-4987-a66b-ab03bd94d16e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgdbjh473q2m", "content": "", "creation_timestamp": "2026-03-05T17:00:15.872464Z"}, {"uuid": "2822e9fe-166b-4144-942c-86a9934da774", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28514", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgfzf3qegx2e", "content": "", "creation_timestamp": "2026-03-06T19:12:38.831377Z"}, {"uuid": "8c705501-d399-4e81-9d07-9f7c37140950", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28272", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfvjus4ru42c", "content": "", "creation_timestamp": "2026-02-28T05:52:30.614404Z"}, {"uuid": "fcd33757-f4df-4328-ac20-b8f94ea6c3a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28710", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgevsmjkkd2x", "content": "", "creation_timestamp": "2026-03-06T08:35:58.067723Z"}, {"uuid": "436062b0-16d1-4af6-8287-2385e9a193b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2845", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mfoqwufv6l2q", "content": "", "creation_timestamp": "2026-02-25T13:10:18.212151Z"}, {"uuid": "4adf286e-66f8-4f96-b737-9d2af499a2d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2830", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgewkafcm227", "content": "", "creation_timestamp": "2026-03-06T08:49:10.588084Z"}, {"uuid": "f61341c2-b880-40ea-846f-a64b036fe86b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28279", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfvlgagipm2h", "content": "", "creation_timestamp": "2026-02-28T06:20:09.529975Z"}, {"uuid": "069fc93b-87a2-4a30-bcbd-18f1d840f9fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2874", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mghkycg5u72m", "content": "", "creation_timestamp": "2026-03-07T10:00:16.726463Z"}, {"uuid": "c462f846-2e58-4f5b-9368-23926bf09c64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28286", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg3t4yydrw2o", "content": "", "creation_timestamp": "2026-03-02T17:54:07.983865Z"}, {"uuid": "e74f2354-b349-434a-be49-fa92ee224768", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2874", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mghkyczb572j", "content": "", "creation_timestamp": "2026-03-07T10:00:17.378947Z"}, {"uuid": "d7ae1c8b-8f1d-4d58-b8be-0819e5057060", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2880", "type": "seen", "source": "https://gist.github.com/alon710/95873439d2452dafcf62d120f48408bf", "content": "", "creation_timestamp": "2026-02-28T06:40:11.000000Z"}, {"uuid": "d1905849-6071-4350-a39d-2a578262f263", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28370", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfyethnwzw2m", "content": "", "creation_timestamp": "2026-03-01T09:00:16.020913Z"}, {"uuid": "f7b6ffc9-1a79-480a-a9fe-e84bb365cfdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28562", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgdcn2jqh423", "content": "", "creation_timestamp": "2026-03-05T17:20:10.585696Z"}, {"uuid": "d1d5df10-0499-4130-830c-5550360b3957", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mg72qyudpu2e", "content": "", "creation_timestamp": "2026-03-04T00:48:33.995625Z"}, {"uuid": "c1a6cbb7-f416-4e3e-b5e1-abcd956410fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28351", "type": "seen", "source": "https://gist.github.com/alon710/8c701e4c3b2c6c36535c668dab067b3c", "content": "", "creation_timestamp": "2026-02-28T07:10:10.000000Z"}, {"uuid": "4d6294b6-299e-4c5b-886b-226ecdd656f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28406", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgg426z4lr2x", "content": "", "creation_timestamp": "2026-03-06T20:00:14.627401Z"}, {"uuid": "0a2808b5-5315-4dd1-9b07-d5d3d4d99060", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28536", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116175393685481196", "content": "", "creation_timestamp": "2026-03-05T07:30:28.849659Z"}, {"uuid": "be0e916c-89c8-4fd2-acf3-91d5cacb198f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28536", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mgcboltqp32m", "content": "", "creation_timestamp": "2026-03-05T07:30:29.135834Z"}, {"uuid": "0d4c2417-2a7d-4e41-9498-40018aca5909", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2884", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfkys527vp24", "content": "", "creation_timestamp": "2026-02-24T01:20:10.237052Z"}, {"uuid": "c55d84f6-e36d-44d4-a608-ff04b3c94211", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28351", "type": "seen", "source": "https://bsky.app/profile/flarestart.bsky.social/post/3mfvpcchift24", "content": "", "creation_timestamp": "2026-02-28T07:29:32.509066Z"}, {"uuid": "63163b26-e42d-45f1-92aa-a28054835ff1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28411", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgamlc4tf62a", "content": "", "creation_timestamp": "2026-03-04T15:40:09.606980Z"}, {"uuid": "0af550a6-ee4d-4c68-90e1-8df963ecc021", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28279", "type": "seen", "source": "https://gist.github.com/alon710/ad7fc02718b15a210a981448af582910", "content": "", "creation_timestamp": "2026-02-28T07:40:11.000000Z"}, {"uuid": "f598e4ee-d28d-443c-960c-8f80552cf8f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28279", "type": "seen", "source": "https://bsky.app/profile/flarestart.bsky.social/post/3mfvqoyw3zh2b", "content": "", "creation_timestamp": "2026-02-28T07:54:32.541590Z"}, {"uuid": "68243b1f-fb4a-4a74-a0ac-be9f2426a435", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28536", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgcdfzwhf42u", "content": "", "creation_timestamp": "2026-03-05T08:01:30.233520Z"}, {"uuid": "f179807c-3779-4a2e-aa15-fc3fd5c7c838", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2885", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfkzvuwy5h2m", "content": "", "creation_timestamp": "2026-02-24T01:40:09.887950Z"}, {"uuid": "5c8cab35-094b-4547-842e-a5b3a1f394d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28193", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfouthkpeo26", "content": "", "creation_timestamp": "2026-02-25T14:19:59.040263Z"}, {"uuid": "3aed64ce-b405-4a00-ba7b-b130596c9d09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2882", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfl2ztmeje22", "content": "", "creation_timestamp": "2026-02-24T02:00:15.605546Z"}, {"uuid": "7a1f977e-dff2-47fd-b51f-c8011c905f44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2881", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfl45fvzha2h", "content": "", "creation_timestamp": "2026-02-24T02:20:09.479312Z"}, {"uuid": "4c0abfc0-74c2-4f26-8f1c-28bbc397c4d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28193", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfoxrojavt2v", "content": "", "creation_timestamp": "2026-02-25T15:12:39.963556Z"}, {"uuid": "7116eab8-57fa-4a8f-8617-9b3f6ad0a288", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28279", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mfvs3rcexy52", "content": "", "creation_timestamp": "2026-02-28T08:19:36.778421Z"}, {"uuid": "39936219-15e4-4fe6-99af-457c03b6f3bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28550", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgcjhe4syc2o", "content": "", "creation_timestamp": "2026-03-05T09:49:35.897227Z"}, {"uuid": "6aba6bb4-6fa1-4719-bbe3-ac8a73a5c00f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2877", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfl5b5rytd2q", "content": "", "creation_timestamp": "2026-02-24T02:40:08.920758Z"}, {"uuid": "68b59693-ea6c-42ae-afba-566c44ad3eee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2893", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgcjk2d2qi2z", "content": "", "creation_timestamp": "2026-03-05T09:51:06.286856Z"}, {"uuid": "8991ba76-12e8-431a-a065-e9d0b2d265b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2876", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfl6f3rqqy2x", "content": "", "creation_timestamp": "2026-02-24T03:00:14.795469Z"}, {"uuid": "32146b70-f23c-4af0-b5bc-30309651773d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28538", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgcjmuyj4d2v", "content": "", "creation_timestamp": "2026-03-05T09:52:41.202337Z"}, {"uuid": "9858585b-d1f1-4c48-9632-bb3bb4735770", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28537", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgcjpuokdi2k", "content": "", "creation_timestamp": "2026-03-05T09:54:21.479390Z"}, {"uuid": "4d090301-96d9-441f-ba0d-500c1a8fa596", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28268", "type": "seen", "source": "https://gist.github.com/alon710/e6e1d06f45ead4fd6adc1a03157a349c", "content": "", "creation_timestamp": "2026-02-28T09:10:10.000000Z"}, {"uuid": "be4d69d4-17b4-4c68-a215-1c21fc8ec7cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28543", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgcjwfmlvm2z", "content": "", "creation_timestamp": "2026-03-05T09:58:00.504229Z"}, {"uuid": "81ce4915-a7ab-4f9b-9a1b-37e9dcaf7dfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28536", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mggaj3y3ex2q", "content": "", "creation_timestamp": "2026-03-06T21:20:10.016468Z"}, {"uuid": "8d9984f9-f752-4600-b4dc-1ea0d4212d50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28541", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgcjzyeqpo2y", "content": "", "creation_timestamp": "2026-03-05T10:00:00.691715Z"}, {"uuid": "e098173f-5d13-4593-bc4d-1cc469f9af67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2873", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfl7iou6nm2e", "content": "", "creation_timestamp": "2026-02-24T03:20:08.940996Z"}, {"uuid": "cfcf4910-b1dc-4c01-a9c5-725f8e120096", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2806", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfqt434nb526", "content": "", "creation_timestamp": "2026-02-26T08:54:19.541527Z"}, {"uuid": "fda9ffa7-7506-4273-a237-4ff0843efc69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2871", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mflamhayx52i", "content": "", "creation_timestamp": "2026-02-24T03:40:09.189140Z"}, {"uuid": "125b8451-86f9-483f-a492-ff02457a3763", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2807", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfqt4cpjfi2s", "content": "", "creation_timestamp": "2026-02-26T08:54:27.842515Z"}, {"uuid": "12301260-1188-4e54-8b0c-af6ef4797c40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2872", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mflbqfifkk2m", "content": "", "creation_timestamp": "2026-02-24T04:00:16.455479Z"}, {"uuid": "5b4084aa-4fcd-4588-a090-84e126db3b48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28131", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfqu6ekfg72x", "content": "", "creation_timestamp": "2026-02-26T09:13:29.988472Z"}, {"uuid": "ebc898f3-e3ce-4b2a-b5e5-633b3ada8e7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28268", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mggcqrhdyb2r", "content": "", "creation_timestamp": "2026-03-06T22:00:15.225807Z"}, {"uuid": "c86538e1-4058-4444-b13a-269ffde12d5c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28484", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf2judv3l2k", "content": "", "creation_timestamp": "2026-03-06T10:00:33.582782Z"}, {"uuid": "d8149c6a-e3c9-4677-b2df-3cdd65caa92e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28083", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfqun4byym2x", "content": "", "creation_timestamp": "2026-02-26T09:21:44.632129Z"}, {"uuid": "62af6ab5-0724-4de2-a2c7-904917d3f1ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28485", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf2k3buwp2d", "content": "", "creation_timestamp": "2026-03-06T10:00:40.690977Z"}, {"uuid": "92258765-99fb-4232-8210-86fb00a8fc3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28132", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfquztknw52x", "content": "", "creation_timestamp": "2026-02-26T09:28:51.610331Z"}, {"uuid": "748bdef7-520b-469f-be24-f3df5b7a2b55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28227", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfsacdlvk32y", "content": "", "creation_timestamp": "2026-02-26T22:23:08.160018Z"}, {"uuid": "5b7bd752-9add-4380-92bd-a1b69a29d5cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28361", "type": "seen", "source": "https://gist.github.com/alon710/6187e996b9891bde691d927e61e7e5eb", "content": "", "creation_timestamp": "2026-03-02T20:10:09.000000Z"}, {"uuid": "53a8f877-2263-406a-9868-a764d274e4b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28484", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf2lkydy42s", "content": "", "creation_timestamp": "2026-03-06T10:01:31.004159Z"}, {"uuid": "52331912-58ee-46ba-9713-8c8cc67e0fc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28138", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfqvbj4ye52e", "content": "", "creation_timestamp": "2026-02-26T09:33:09.234588Z"}, {"uuid": "1100f046-ef95-49c1-bf6c-6917acb53cb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28218", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfsahuhdrx2v", "content": "", "creation_timestamp": "2026-02-26T22:26:13.386501Z"}, {"uuid": "76ae8a6f-bf6d-4615-be89-b651b44a9ba1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28219", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfsaku6hvd2o", "content": "", "creation_timestamp": "2026-02-26T22:27:53.655677Z"}, {"uuid": "7d342f7c-b91a-4481-8955-b81ed5a6a5f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2856", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mflctxtdr22m", "content": "", "creation_timestamp": "2026-02-24T04:20:08.760550Z"}, {"uuid": "a24e4375-67ed-445e-8639-ba8abd74cc5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2857", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mfldxqoj3p22", "content": "", "creation_timestamp": "2026-02-24T04:40:09.344204Z"}, {"uuid": "f07ea49d-2047-4165-842e-088faef643ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2800", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mfqvgx7kzo2v", "content": "", "creation_timestamp": "2026-02-26T09:36:12.809323Z"}, {"uuid": "ab6251b5-5536-4c26-bc51-86f7e48e768a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2853", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mflf3o47j42m", "content": "", "creation_timestamp": "2026-02-24T05:00:14.619446Z"}, {"uuid": "1ea53872-7849-4701-b1c7-27572cae5357", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28136", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfqw4eiiqd2e", "content": "", "creation_timestamp": "2026-02-26T09:48:10.121456Z"}, {"uuid": "d12b19f4-6e61-4368-ad28-8d58c64e087b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2855", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mflg7ch4in2m", "content": "", "creation_timestamp": "2026-02-24T05:20:10.327105Z"}, {"uuid": "1c0159b0-dc2e-42c9-89d0-abdb9d753e02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28514", "type": "seen", "source": "https://github.blog/security/how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework/", "content": "", "creation_timestamp": "2026-03-06T20:09:04.000000Z"}, {"uuid": "374dc548-03c8-4e9b-9e3b-2d663beafd79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28479", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgf3fyf62k2f", "content": "", "creation_timestamp": "2026-03-06T10:16:17.042177Z"}, {"uuid": "b4ed52db-6e18-48e3-9ac2-4ec3d9a008e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28115", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgdk3hvnwq2t", "content": "", "creation_timestamp": "2026-03-05T19:33:30.585325Z"}, {"uuid": "f2c83505-0106-4b27-a1a5-69ec6b8b7f8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28118", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgdk3oxtlt2h", "content": "", "creation_timestamp": "2026-03-05T19:33:38.069359Z"}, {"uuid": "e8906727-1c4e-4ed7-9af4-56a5d13698f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28120", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgdklejqfz25", "content": "", "creation_timestamp": "2026-03-05T19:42:24.369417Z"}, {"uuid": "cb95e0b3-5844-425e-b03e-637baeb98432", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28105", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mgdklldaer25", "content": "", "creation_timestamp": "2026-03-05T19:42:31.259337Z"}, {"uuid": "bc269651-54e6-4674-83a3-0893405fc44f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2831", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mfttne7xzg2z", "content": "", "creation_timestamp": "2026-02-27T13:41:58.301982Z"}, {"uuid": "532a8960-bd76-4639-877a-c8ccf585dd25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28414", "type": "seen", "source": "https://bsky.app/profile/reybango.bsky.social/post/3mg4c4h3bis2e", "content": "", "creation_timestamp": "2026-03-02T22:22:10.387990Z"}, {"uuid": "44ccdd4e-5a3a-4676-b39b-5a9e9560187b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28696", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgauuz2k3r2u", "content": "", "creation_timestamp": "2026-03-04T18:08:45.567648Z"}, {"uuid": "5e437041-4359-4a8c-ad5a-cb4ecbcecad5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28289", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116168669779819860", "content": "", "creation_timestamp": "2026-03-04T03:00:29.404486Z"}, {"uuid": "45473b65-8749-4d71-bd3f-a02f48bf243b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28697", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgav4onbmc2u", "content": "", "creation_timestamp": "2026-03-04T18:13:06.106025Z"}, {"uuid": "1145eef7-7aa4-4044-ba86-c53240fe12f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28289", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mg7c4w55aw2h", "content": "", "creation_timestamp": "2026-03-04T03:00:30.443046Z"}, {"uuid": "ec473bfd-8c96-4593-89fa-609722d9f912", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28784", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgavfpvob72o", "content": "", "creation_timestamp": "2026-03-04T18:18:06.395795Z"}, {"uuid": "d03f8a4b-edaf-4e79-9a7c-02c9548e186c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28410", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgdrnyedoi2x", "content": "", "creation_timestamp": "2026-03-05T21:49:08.289977Z"}, {"uuid": "3cd30ff1-c722-4d7d-9379-d7d45492964f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2867", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mflsitdg4u24", "content": "", "creation_timestamp": "2026-02-24T09:00:14.888051Z"}, {"uuid": "8e6762db-fee1-40bc-b0a2-7c64797e0e13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28353", "type": "seen", "source": "https://bsky.app/profile/secqube.com/post/3mghmurimoz27", "content": "", "creation_timestamp": "2026-03-07T10:34:06.760025Z"}, {"uuid": "09da7d99-244a-4155-a39a-d18206e98b5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28783", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgavxmrtrw2x", "content": "", "creation_timestamp": "2026-03-04T18:28:07.275940Z"}, {"uuid": "5504137e-f47f-46cf-b81b-12fb8c891566", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28430", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116241573279155444", "content": "", "creation_timestamp": "2026-03-17T00:00:47.859814Z"}, {"uuid": "14c90038-06de-47cb-8bc0-b36da66ddcae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28859", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116299318674903445", "content": "", "creation_timestamp": "2026-03-27T04:46:12.174777Z"}, {"uuid": "352f2b58-376a-4c21-9b33-ba3014964db5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28753", "type": "seen", "source": "https://my.f5.com/manage/s/article/K000160366", "content": "", "creation_timestamp": "2026-03-25T03:00:09.000000Z"}, {"uuid": "7492ad32-069d-4f50-b5ab-7f2aad07fe75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28490", "type": "seen", "source": "https://gist.github.com/alon710/2d123731c9da93f7319d6377d20965fd", "content": "", "creation_timestamp": "2026-03-16T18:10:06.000000Z"}, {"uuid": "a968a701-338c-48b4-8abc-e9aa53114779", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28298", "type": "seen", "source": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28297", "content": "", "creation_timestamp": "2026-03-27T03:00:06.000000Z"}, {"uuid": "651335e4-14fd-4065-893d-a0924a8077ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28297", "type": "seen", "source": "https://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28297", "content": "", "creation_timestamp": "2026-03-27T03:00:06.000000Z"}, {"uuid": "edfd26ef-615a-470e-be79-01896fa4cb4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28680", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhoguabdtp2m", "content": "", "creation_timestamp": "2026-03-22T21:00:15.269229Z"}, {"uuid": "683e66a0-cf48-49cc-b1e0-74600e4bc56a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28505", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miciq7c3xk2o", "content": "", "creation_timestamp": "2026-03-30T20:27:02.186564Z"}, {"uuid": "80055dd8-f0f3-4055-8cc6-75c1f3f080eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28500", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mhm2b7oxio2g", "content": "", "creation_timestamp": "2026-03-21T22:09:32.575018Z"}, {"uuid": "4e66ca0a-06e6-43dd-a06b-41c6082a036e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28373", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mhusgbpy6b2e", "content": "", "creation_timestamp": "2026-03-25T09:43:10.086132Z"}, {"uuid": "bcb1e299-458a-4c33-8d27-1e4afe3c8428", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28384", "type": "seen", "source": "https://bsky.app/profile/secqube.com/post/3mi3m337grz2l", "content": "", "creation_timestamp": "2026-03-28T02:38:09.971895Z"}, {"uuid": "c4a05773-5c3c-4a28-b5ef-6c277a95e8de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28859", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116288631079391237", "content": "", "creation_timestamp": "2026-03-25T07:28:12.922998Z"}, {"uuid": "5edcf40f-35c5-48f5-9fe6-74b38004cc51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28430", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-28430", "content": "", "creation_timestamp": "2026-03-16T19:16:17.000000Z"}, {"uuid": "abb856c6-27f6-41e2-b96c-722088f33d29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28479", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhbq2ksifi2r", "content": "", "creation_timestamp": "2026-03-17T19:40:14.865030Z"}, {"uuid": "2c43939d-2b79-4f52-9e9e-170b2ff53361", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28472", "type": "seen", "source": "https://gist.github.com/alon710/ba8dc0788a471b5a92fb9d0637418df7", "content": "", "creation_timestamp": "2026-03-11T12:00:06.000000Z"}, {"uuid": "a82aabe1-ce03-446f-89ce-9813dfbcfe81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28295", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mhqta33v322l", "content": "", "creation_timestamp": "2026-03-23T19:47:01.942085Z"}, {"uuid": "1a1fb0cf-1da3-4b01-9178-4341d3867ce8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28296", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mhqta33v322l", "content": "", "creation_timestamp": "2026-03-23T19:47:02.051493Z"}, {"uuid": "16b1bc7c-72a9-4e5b-a2e4-cc32efadd642", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28895", "type": "seen", "source": "https://bsky.app/profile/archange-shadows.com/post/3mhwo2dm5uy25", "content": "", "creation_timestamp": "2026-03-26T03:30:14.082613Z"}, {"uuid": "26685d7d-cb31-4ae0-97ad-21d37b511885", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28462", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3miaoafxlsg2f", "content": "", "creation_timestamp": "2026-03-30T03:00:15.816416Z"}, {"uuid": "1fddf5b1-ca3c-4dec-b3f9-81eecafd16b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28495", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgvpm4fofr23", "content": "", "creation_timestamp": "2026-03-13T01:00:13.393074Z"}, {"uuid": "b7e91a83-6560-4681-84ee-c276a09920dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28877", "type": "seen", "source": "https://bsky.app/profile/rosyna.bsky.social/post/3mhwrfrrf622f", "content": "", "creation_timestamp": "2026-03-26T04:30:21.927200Z"}, {"uuid": "e1214d7f-0ae8-4748-abb9-2185afaa2d75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28676", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhdnji2n2c24", "content": "", "creation_timestamp": "2026-03-18T14:00:13.151018Z"}, {"uuid": "d319d595-1bd8-4995-a30f-f4e27cb4e36e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28418", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "9871b73a-3344-4c24-907e-01e3efeb56e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28417", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "a4725e73-b3df-4dfa-84c9-06b3dc4ca4c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28461", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhhbqon5zr2u", "content": "", "creation_timestamp": "2026-03-20T00:40:09.046151Z"}, {"uuid": "94639b3c-2f61-44ef-a35b-7c9b4cc594b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28419", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "c3079695-7d4d-46c1-beb1-9787430fbb47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28420", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "682c42e9-330c-4b89-9c67-512376bc5e74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28421", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "3f3f2e6b-73ee-412c-ab20-9f6de9ba806d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28422", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/", "content": "", "creation_timestamp": "2026-03-19T00:00:00.000000Z"}, {"uuid": "e4ecd542-b6bf-441e-8923-f62b9367511b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28793", "type": "seen", "source": "https://gist.github.com/alon710/741d463a436134d071dd4a30bdde2bd7", "content": "", "creation_timestamp": "2026-03-13T06:40:06.000000Z"}, {"uuid": "fa36aff5-9433-4c6b-9cb8-ee77cd9dc36d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28792", "type": "seen", "source": "https://gist.github.com/alon710/0e6eec2064b4743b4eb8bdf61f0e25e5", "content": "", "creation_timestamp": "2026-03-13T07:10:06.000000Z"}, {"uuid": "52feadb2-f455-4a67-b348-3defa46e7eba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28888", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "f84c54a4-91db-41f2-bade-e24e9f486720", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28809", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhq3c2adwb2e", "content": "", "creation_timestamp": "2026-03-23T12:38:32.861596Z"}, {"uuid": "862517d7-d48f-4750-b631-368bc8a68dd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28356", "type": "seen", "source": "https://gist.github.com/alon710/1a09f125fb195b968cc4199dda20a349", "content": "", "creation_timestamp": "2026-03-13T07:40:05.000000Z"}, {"uuid": "a3fac315-5faf-40eb-8a95-5c42f35a1aa5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28688", "type": "seen", "source": "https://infosec.exchange/users/certvde/statuses/116316841599408182", "content": "", "creation_timestamp": "2026-03-30T07:02:33.767375Z"}, {"uuid": "cce10402-f217-4124-a3ae-11a936a2d659", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28692", "type": "seen", "source": "https://infosec.exchange/users/certvde/statuses/116316841599408182", "content": "", "creation_timestamp": "2026-03-30T07:02:34.339259Z"}, {"uuid": "b474a8ca-7b99-4e82-8455-60dbb9cffb75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28691", "type": "seen", "source": "https://infosec.exchange/users/certvde/statuses/116316841599408182", "content": "", "creation_timestamp": "2026-03-30T07:02:31.657894Z"}, {"uuid": "6e80ba68-e3aa-4355-b794-2d3526e8a1e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28494", "type": "seen", "source": "https://infosec.exchange/users/certvde/statuses/116316841599408182", "content": "", "creation_timestamp": "2026-03-30T07:02:32.918659Z"}, {"uuid": "dca78513-5d7a-4288-b9ae-7d138cd0d91f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28687", "type": "seen", "source": "https://infosec.exchange/users/certvde/statuses/116316841599408182", "content": "", "creation_timestamp": "2026-03-30T07:02:33.694654Z"}, {"uuid": "66dd0878-b9fc-4ac5-a801-e65522f4be9e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28690", "type": "seen", "source": "https://infosec.exchange/users/certvde/statuses/116316841599408182", "content": "", "creation_timestamp": "2026-03-30T07:02:33.249919Z"}, {"uuid": "96e8e700-23dd-45f8-8ce6-17111c26ed0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28693", "type": "seen", "source": "https://infosec.exchange/users/certvde/statuses/116316841599408182", "content": "", "creation_timestamp": "2026-03-30T07:02:31.434320Z"}, {"uuid": "f1b99968-8f23-4415-9446-ef94356ad66b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28689", "type": "seen", "source": "https://infosec.exchange/users/certvde/statuses/116316841599408182", "content": "", "creation_timestamp": "2026-03-30T07:02:33.387101Z"}, {"uuid": "e02d3daa-53a8-4437-a71f-52efcecf7cf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28686", "type": "seen", "source": "https://infosec.exchange/users/certvde/statuses/116316841599408182", "content": "", "creation_timestamp": "2026-03-30T07:02:33.167276Z"}, {"uuid": "2bf6b733-eb6f-4848-bb80-093fd3950946", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28493", "type": "seen", "source": "https://infosec.exchange/users/certvde/statuses/116316841599408182", "content": "", "creation_timestamp": "2026-03-30T07:02:33.318887Z"}, {"uuid": "14ce4436-4fc9-4bbc-86a5-10da411e3cad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28298", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhy4iik56q2z", "content": "", "creation_timestamp": "2026-03-26T17:21:20.988391Z"}, {"uuid": "77810643-5942-4422-b2db-36f58d23281f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28877", "type": "seen", "source": "https://support.apple.com/en-us/126794", "content": "", "creation_timestamp": "2026-03-26T03:00:11.000000Z"}, {"uuid": "914a59e9-312b-4625-83e1-e24a361bf749", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28297", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhy4v6mpeg2z", "content": "", "creation_timestamp": "2026-03-26T17:28:26.882471Z"}, {"uuid": "c35c4b01-3ee6-4fc3-b7c8-628858f1d3db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28823", "type": "seen", "source": "https://support.apple.com/en-us/126794", "content": "", "creation_timestamp": "2026-03-26T03:00:11.000000Z"}, {"uuid": "70e0fda9-1d81-45af-8a4c-b449ea60fac0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28824", "type": "seen", "source": "https://support.apple.com/en-us/126794", "content": "", "creation_timestamp": "2026-03-26T03:00:11.000000Z"}, {"uuid": "ba8420ab-0faf-4569-af98-c2c2740076ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28204", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-078-06", "content": "", "creation_timestamp": "2026-03-19T11:00:00.000000Z"}, {"uuid": "5dd2c30a-b2e2-4fe8-89cc-74f935141f79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28879", "type": "seen", "source": "https://support.apple.com/en-us/126794", "content": "", "creation_timestamp": "2026-03-26T03:00:11.000000Z"}, {"uuid": "c84ce77e-e93e-4e50-8836-00dec78e19f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28894", "type": "seen", "source": "https://support.apple.com/en-us/126794", "content": "", "creation_timestamp": "2026-03-26T03:00:11.000000Z"}, {"uuid": "7208a33c-630c-42db-a990-3a8dd8f8c5de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28866", "type": "seen", "source": "https://support.apple.com/en-us/126794", "content": "", "creation_timestamp": "2026-03-26T03:00:11.000000Z"}, {"uuid": "ae95eecb-a8f3-4ae7-9045-40e75853bae7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28384", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mi7zeyhahc2b", "content": "", "creation_timestamp": "2026-03-29T20:47:04.179727Z"}, {"uuid": "1a240865-6977-4208-a521-58f6445480b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28821", "type": "seen", "source": "https://support.apple.com/en-us/126794", "content": "", "creation_timestamp": "2026-03-26T03:00:11.000000Z"}, {"uuid": "4254cf7a-da32-4086-9b99-73b7919bba6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28838", "type": "seen", "source": "https://support.apple.com/en-us/126794", "content": "", "creation_timestamp": "2026-03-26T03:00:11.000000Z"}, {"uuid": "1ed12d23-5185-4dc3-b0d0-931dc258fb4d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28886", "type": "seen", "source": "https://support.apple.com/en-us/126794", "content": "", "creation_timestamp": "2026-03-26T03:00:11.000000Z"}, {"uuid": "63603b12-8d38-4b05-8aa7-460c7053a56a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28372", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mhkolymvmy2l", "content": "", "creation_timestamp": "2026-03-21T09:08:10.077574Z"}, {"uuid": "6d984a23-0190-42e6-b51b-2c2e1b061075", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28865", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "52c6d672-fe6a-49fa-b588-3065bf3bfacd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28877", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "1e3d9c45-f842-4e75-a476-39695a1afe56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-2837", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-2837", "content": "", "creation_timestamp": "2026-03-21T03:17:12.000000Z"}, {"uuid": "11b7494b-f6c1-40c8-822e-c31783a3d1c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28824", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "4f6812a7-354d-4084-a562-0130774c06bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28435", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mhieznfew22h", "content": "", "creation_timestamp": "2026-03-20T11:11:34.699603Z"}, {"uuid": "0132fafa-7883-4ad6-91e4-2043a9a37dbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28879", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "2df717ad-87bd-4f66-b103-ea77148b05c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28822", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "fa66b49d-b3f0-45e8-b867-d9597c473ab2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28827", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "c64ed3f3-beeb-4e33-b9e7-eec6f02ed9f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28894", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "d7b2e42b-8005-4a3c-ae51-c6a4d27920f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28866", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "61c5e353-cece-48c7-ab80-d154e99faa0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28821", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "b407d318-688d-4919-980c-e21d63e60ddb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28838", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "b323b54d-a86a-42d9-b525-3eb24a9758f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28886", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "7962ef27-36b6-4891-86d7-618733819a3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28529", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhvbbzwknb2i", "content": "", "creation_timestamp": "2026-03-25T14:09:13.858923Z"}, {"uuid": "a82b3aae-c66f-4e41-91d3-7773070afb97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28876", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "e5472d6e-ca9e-4546-b1b3-19e7e9a3ef5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28892", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "e5fc2869-bec9-4cd1-86ae-ca330f899662", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-2808", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-2808", "content": "", "creation_timestamp": "2026-03-11T23:16:11.000000Z"}, {"uuid": "79db1765-be27-42d5-9388-1ad7b459461d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28832", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "b60e7f16-e2f1-4fc4-9adc-465f29aab7b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28834", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "55c5685c-de01-442e-8399-c9def924b539", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28880", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "9543b8cd-80ac-43e4-abb5-e7523c26a907", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28868", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "cb8f26c4-ff8a-4d0b-9b36-b99dc5f567b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28867", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "050c0dab-3240-4914-b78c-c1702eb1e56f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28829", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "51318910-be54-4d56-a2a6-ba6cbff6a520", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28891", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "251cd617-3986-491d-9b58-a2eeedc175a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28519", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhbh4h2rtx2u", "content": "", "creation_timestamp": "2026-03-17T17:00:14.178608Z"}, {"uuid": "014d915a-b06f-46bb-a9e0-734ad08cfd94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28373", "type": "seen", "source": "https://bsky.app/profile/rcesecurity.com/post/3mhssy6a3tc2r", "content": "", "creation_timestamp": "2026-03-24T14:47:52.432624Z"}, {"uuid": "2490800b-f788-4574-8804-84cd4d9ad4e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28839", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "bc69b0c3-f97b-453e-aee2-24ace0065eac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28816", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "ce98e10f-713b-4a8a-a691-1f027f8c2ca4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28727", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-acronis", "content": "", "creation_timestamp": "2026-03-06T13:03:05.000000Z"}, {"uuid": "1b810e72-5ea5-4c45-9205-ab566dd1dadd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28721", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-acronis", "content": "", "creation_timestamp": "2026-03-06T13:03:05.000000Z"}, {"uuid": "6cfca3ae-f5b8-49e4-aa4b-84e0c7c6331f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28713", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-acronis", "content": "", "creation_timestamp": "2026-03-06T13:03:05.000000Z"}, {"uuid": "8f773554-55de-490f-83c2-40f8ea4339d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28710", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-acronis", "content": "", "creation_timestamp": "2026-03-06T13:03:05.000000Z"}, {"uuid": "cd6e6664-a9b6-4a5a-912c-ae119c6b35d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28229", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhiswap5ma2x", "content": "", "creation_timestamp": "2026-03-20T15:20:09.096522Z"}, {"uuid": "7c6d5150-b1f6-458d-9316-d2255eb53c8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28755", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mhvcqjgua623", "content": "", "creation_timestamp": "2026-03-25T14:35:13.917174Z"}, {"uuid": "2232b88c-641a-462e-bf2f-de393fc46038", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28722", "type": "seen", "source": "https://www.acn.gov.it/portale/w/rilevate-vulnerabilita-in-prodotti-acronis", "content": "", "creation_timestamp": "2026-03-06T13:03:05.000000Z"}, {"uuid": "fd89659e-cf10-4ecd-a545-a9e87e4bd319", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28753", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mhvcqjgua623", "content": "", "creation_timestamp": "2026-03-25T14:35:13.701689Z"}, {"uuid": "5af2eea3-9bac-4f69-9147-c8885ac0b1a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28506", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-28506", "content": "", "creation_timestamp": "2026-03-17T15:16:20.000000Z"}, {"uuid": "75cbc0c2-654a-49b1-b484-ef08f902b0ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28803", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-28803", "content": "", "creation_timestamp": "2026-03-11T15:16:40.000000Z"}, {"uuid": "04d8327c-18b0-4f70-b899-6af0c74a81ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28229", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-28229", "content": "", "creation_timestamp": "2026-03-11T15:16:40.000000Z"}, {"uuid": "3fb2d81a-c9a9-436a-be04-d82b02829831", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28857", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116294045636134722", "content": "", "creation_timestamp": "2026-03-26T06:25:12.415246Z"}, {"uuid": "89ad168c-0f23-4e73-9d02-49ee5a930157", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28500", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mheeyitdpb2h", "content": "", "creation_timestamp": "2026-03-18T21:00:13.525885Z"}, {"uuid": "a74445a1-3e97-42e4-98c6-bca245c2c9d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28894", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "55be682b-dcad-49a6-b5bb-5fe1be5f14e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28822", "type": "seen", "source": "https://support.apple.com/en-us/126794", "content": "", "creation_timestamp": "2026-03-26T03:00:11.000000Z"}, {"uuid": "38a45089-076c-4dd1-baea-03f2c4f23bb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28442", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgukpxxu3o22", "content": "", "creation_timestamp": "2026-03-12T14:00:14.642814Z"}, {"uuid": "23c79af7-774f-483b-805f-d9eb0761f017", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28865", "type": "seen", "source": "https://support.apple.com/en-us/126794", "content": "", "creation_timestamp": "2026-03-26T03:00:11.000000Z"}, {"uuid": "331a5da5-520f-4161-b43c-4bbaa57229d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28364", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mgulbop57l2s", "content": "", "creation_timestamp": "2026-03-12T14:10:08.472837Z"}, {"uuid": "8ea25d7d-03ef-4003-891c-3172a791722a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28779", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhbyrtdvcd2s", "content": "", "creation_timestamp": "2026-03-17T22:16:26.026852Z"}, {"uuid": "f656d797-42e2-41ab-a0c4-62fb324a69f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28852", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "764ffe63-4cc5-4fe1-b0d8-ce580faac555", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28267", "type": "seen", "source": "https://jvn.jp/en/jp/JVN17307628/", "content": "", "creation_timestamp": "2026-03-09T06:15:00.000000Z"}, {"uuid": "bbf36da0-9cfc-4910-954b-067e35c06917", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28828", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "cdb85427-6fd5-43db-a13b-ee98f929fc7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28818", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "04e1402c-641d-4133-bd2b-89fdcbe0843a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28825", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "9ce03259-db5a-471c-bab6-6ad58ee8784b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28835", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "d37d6a40-7f1b-4472-a424-bb4ab7b3bfdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28895", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhtyausx6u23", "content": "", "creation_timestamp": "2026-03-25T01:54:51.572128Z"}, {"uuid": "98e01997-94d5-4fb5-b587-f79fa6259e2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28864", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "5822b36c-f335-427a-ad05-4517e3f50314", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28891", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhtydkxlzs2t", "content": "", "creation_timestamp": "2026-03-25T01:56:21.923302Z"}, {"uuid": "d1eeae7c-cdf6-4621-b777-65ff0d01dac8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28373", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3mhvenva7qm27", "content": "", "creation_timestamp": "2026-03-25T15:09:32.919769Z"}, {"uuid": "c8aec6ac-86f3-4e59-8f70-ff2d5c8eb0b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28894", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhtygfnt6g23", "content": "", "creation_timestamp": "2026-03-25T01:57:56.925870Z"}, {"uuid": "f5a87e31-fc7e-424c-9b28-0262d508ef12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28817", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "a13c0dc6-f378-4f85-8f9e-4d4235679b84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28831", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "4938ced4-086e-49e4-92b1-445f3705cc40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28888", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhtymknxln22", "content": "", "creation_timestamp": "2026-03-25T02:01:23.854662Z"}, {"uuid": "45316007-81d9-4e76-a950-1767b7e7ba02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28862", "type": "seen", "source": "https://support.apple.com/en-us/126795", "content": "", "creation_timestamp": "2026-03-26T03:00:12.000000Z"}, {"uuid": "8e9761e0-5f4e-456b-b653-08f12c1eb8ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28892", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhtypwbd462q", "content": "", "creation_timestamp": "2026-03-25T02:03:16.230494Z"}, {"uuid": "8494758c-05d2-413b-9b2e-49faf40a9cfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28878", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhtytizzgg24", "content": "", "creation_timestamp": "2026-03-25T02:05:16.659987Z"}, {"uuid": "1a42ac8a-4e01-45d5-a1a4-9731b42c45c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28865", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "87ded57b-28d6-4043-83ac-1906c252d41f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28881", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhtyxdygvm25", "content": "", "creation_timestamp": "2026-03-25T02:07:25.558640Z"}, {"uuid": "bde07ac9-0fec-4f7f-9f2a-d7f5c7464081", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28890", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhtz3ielhy23", "content": "", "creation_timestamp": "2026-03-25T02:09:44.671253Z"}, {"uuid": "7153b5a4-88be-4227-b457-2e737e7923d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28877", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhtz7xrmze2j", "content": "", "creation_timestamp": "2026-03-25T02:12:14.881833Z"}, {"uuid": "99329399-310f-4184-9493-4a3c8f9e8398", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28874", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhtzeu5pwf2o", "content": "", "creation_timestamp": "2026-03-25T02:14:58.719111Z"}, {"uuid": "a2bcd6ee-b4df-43e1-990f-1a0ac877dedc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28876", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhtzka5f2u2j", "content": "", "creation_timestamp": "2026-03-25T02:17:59.033082Z"}, {"uuid": "21fa780d-0d97-4ac1-8b36-4751550aba04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28880", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhtzq77y5e2i", "content": "", "creation_timestamp": "2026-03-25T02:21:19.515687Z"}, {"uuid": "0bddf73f-7a6b-443f-8ada-83909dff2c62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28824", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "aa11348d-c5e0-4df3-967a-4f4cb9bd4c38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28893", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhtzww56ho27", "content": "", "creation_timestamp": "2026-03-25T02:25:08.791580Z"}, {"uuid": "aad87dfc-dc27-4509-9079-79f7a7c76372", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28879", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "35b069e5-d0f4-4035-892e-8650b334a4c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28822", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "907e465c-0c2e-48e9-98b9-313e412f87e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28866", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "82be28e9-0627-4a47-bf68-86008d989320", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28875", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhu26p4mfm2t", "content": "", "creation_timestamp": "2026-03-25T02:29:25.831938Z"}, {"uuid": "4a606b39-8a1c-423b-b21a-56101bcb6337", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28889", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhu2hnk3fc2i", "content": "", "creation_timestamp": "2026-03-25T02:34:26.186445Z"}, {"uuid": "d9879c72-2e1d-4c08-b996-cddb913a56be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28821", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "9f492eb9-5656-4106-98e0-5759c234e344", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28882", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhu2qlx3rv2g", "content": "", "creation_timestamp": "2026-03-25T02:39:26.613317Z"}, {"uuid": "aa78e59b-aab9-4749-98fe-d38d2ef56a5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28886", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "31e0a42e-16b4-4f9c-98fd-5c18f1f9d43c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28878", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "06a0aef1-5fe0-4e22-ad99-d4e8029829f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28886", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhu2zkefnr24", "content": "", "creation_timestamp": "2026-03-25T02:44:27.016900Z"}, {"uuid": "b3f33b18-bd91-4bb4-a32a-9b8fc918eac6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28817", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhvkso7h6c27", "content": "", "creation_timestamp": "2026-03-25T16:59:35.769077Z"}, {"uuid": "3e3c827e-e464-481a-9570-193be5487fb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28834", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "d02021e4-a42a-4388-bde8-f8f11c82fb25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28879", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhu3cirkux22", "content": "", "creation_timestamp": "2026-03-25T02:49:27.196899Z"}, {"uuid": "9c30dc8f-52ed-4239-8658-f59d3850fb1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28880", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "b23b2026-8317-4f92-a7f6-04ebfb65016a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28835", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "8b4ec295-bd97-41d5-ba94-2a8799875576", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28868", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "2bf905ed-7e9c-40c7-acbc-d75d49126ed3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28829", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "fa94ba3a-acba-402c-a7e3-34dffa1190d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28430", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhej5wtvci2s", "content": "", "creation_timestamp": "2026-03-18T22:14:51.333471Z"}, {"uuid": "f52cea4f-b9ff-4388-847f-1854f38974b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28891", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "ad00c556-8579-47a3-9754-e11fb2328623", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28384", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mguqq7ejzl2e", "content": "", "creation_timestamp": "2026-03-12T15:47:44.229267Z"}, {"uuid": "e4ac0c81-2635-422a-ae65-b16e24b8e8f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28839", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "e4c1f26d-fbe1-4c67-975f-541347824329", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28827", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "d24a5d05-9d3a-46d6-b373-1287767db926", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28816", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "119ed374-9086-4524-b479-52cc4fa7c3a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28500", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhcht4gsjo25", "content": "", "creation_timestamp": "2026-03-18T02:45:35.557951Z"}, {"uuid": "9f7ee8f9-a4f5-492c-b2a0-a79975ac7816", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28862", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "1d9e6265-d05f-42f8-914d-cc71a4ca97f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28831", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "f6d1ff3c-a2da-447b-a655-58fef7898bba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28817", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "aeb8d4c9-18ef-402a-ac70-ee58e328cabe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28864", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "64e8a253-f844-4f23-a1cb-343c466c0bf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28498", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mheloq2uhh2h", "content": "", "creation_timestamp": "2026-03-18T23:00:03.646518Z"}, {"uuid": "d212b4d4-44d8-4457-a91e-d50d5d753fc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28825", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "baffd36d-e631-4985-a8e8-5ae803a660a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28818", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "13456b89-cdba-4999-a29a-9a01fbef1624", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28888", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "d1044a7d-2980-49df-bc5e-a394f557358d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28876", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "a8a1e672-6f19-4774-a6ff-00c1c0d7455b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28892", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "6a403dd0-af70-43b7-84f3-736bdd67e728", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28832", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "9119c265-7c17-4748-8bb1-74ab4e62be28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28521", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhcrlbmro72m", "content": "", "creation_timestamp": "2026-03-18T05:40:09.911801Z"}, {"uuid": "1eb9ef73-28b2-4bc6-9fbd-c3b6e86f810f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28760", "type": "seen", "source": "https://jvn.jp/en/jp/JVN08057419/", "content": "", "creation_timestamp": "2026-03-26T03:00:15.000000Z"}, {"uuid": "82b59837-ae7d-445b-a5c9-81c086df1b86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28377", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhynbb2tnv2s", "content": "", "creation_timestamp": "2026-03-26T22:21:32.880345Z"}, {"uuid": "19ef7776-80d1-495c-bcb0-89104a752978", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28369", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mi2tum4l4t2d", "content": "", "creation_timestamp": "2026-03-27T19:25:10.969748Z"}, {"uuid": "a2a094b4-5ded-4702-a34d-8262b91b6e6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28377", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhync67ola27", "content": "", "creation_timestamp": "2026-03-26T22:22:03.172248Z"}, {"uuid": "28d88977-9dbe-4251-b3aa-8a942dc2d855", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28877", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "4cfc42b0-9e39-4019-b14a-7b756d1e36f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28253", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01", "content": "", "creation_timestamp": "2026-03-12T11:00:00.000000Z"}, {"uuid": "01f6e8c1-4548-4d6a-975b-b8f38aad51fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28894", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "6edf866e-2767-4a42-81db-f7927d930ba7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28760", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhx2uv3j7o2p", "content": "", "creation_timestamp": "2026-03-26T07:19:50.747503Z"}, {"uuid": "e5fe2017-4cd5-404e-bfa5-7a481682448a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28892", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "437aedee-77ef-4480-acad-2282a9406643", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28288", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-28288.yaml", "content": "", "creation_timestamp": "2026-03-26T12:02:25.000000Z"}, {"uuid": "60fc2015-e9bd-4964-a8ee-01963713f8db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28893", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "dda949a5-899a-4307-9e62-cf32898e8487", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28288", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mi5jsrbbfx2p", "content": "", "creation_timestamp": "2026-03-28T21:03:04.673275Z"}, {"uuid": "72f3e1b9-d74a-4df4-b75f-8738ab9d426b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28886", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "a05d94ea-2645-49a6-901c-e39bfad9dccd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28895", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "f387ac8f-fe16-4680-b794-c3ce3aaf8128", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28890", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "11086acb-604a-4fbf-ba84-1b4d9455f54d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28878", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "eb7af50e-26b9-440b-9f14-db9ba66d1a43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28882", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "8774648d-fe0c-4ffb-87b4-c235617ece5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28827", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "3d22b82c-3aa4-4a46-811a-c0ad1cd72fd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28857", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "b0b884d6-c767-4563-9603-295258e3af3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28881", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "f0b7fc99-4fa9-4309-a39d-89c9ac5a70f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28838", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "a514e48c-7471-4e23-9de0-47fc44ee99b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28856", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "7bc42e39-9795-4a76-9517-9a88d88d668e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28828", "type": "seen", "source": "https://support.apple.com/en-us/126796", "content": "", "creation_timestamp": "2026-03-26T03:00:13.000000Z"}, {"uuid": "141c8966-0c26-46d8-8c16-6113500ca3c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28880", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "30cc288b-98a3-48c5-aa47-786a7e04004f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28879", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "bceffd19-5aa9-4e99-919d-aa4dea24b1f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28876", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "731ac2c4-0201-4346-a21f-ee601f55f280", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28864", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "b410126d-68a5-4b02-b351-82debdbf5bad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28862", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "cfba1c39-e09a-4250-8624-19cdce9492b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28867", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "c4aaa55c-32f3-41f6-9309-e08feee64089", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28874", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "d1c1ab97-098d-4c97-9453-e0f81b349431", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28252", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01", "content": "", "creation_timestamp": "2026-03-12T11:00:00.000000Z"}, {"uuid": "4074369e-6006-4134-b77a-9231cea567b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28852", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "021050ab-cc27-4079-bb46-691ac683ad59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28254", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01", "content": "", "creation_timestamp": "2026-03-12T11:00:00.000000Z"}, {"uuid": "2554cc6b-9682-4316-ad4d-3752d3c0260c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28461", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mhezfuf2bx2d", "content": "", "creation_timestamp": "2026-03-19T03:05:37.221634Z"}, {"uuid": "43dba6b4-fd75-478f-8f72-129c7df9fef8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28845", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "f1866585-b3c7-46e8-863e-a9992052e21d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28760", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mhxaivzd6k2y", "content": "", "creation_timestamp": "2026-03-26T09:00:30.853558Z"}, {"uuid": "3fb684a3-9e73-4ffc-851d-1c09de0fde85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28255", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01", "content": "", "creation_timestamp": "2026-03-12T11:00:00.000000Z"}, {"uuid": "ebf8ed4b-db95-4183-8bf1-5b992fff34e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28844", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "d256b458-a646-4987-82e6-f5aa8345528b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28760", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116294656216482224", "content": "", "creation_timestamp": "2026-03-26T09:00:31.309001Z"}, {"uuid": "cf4bb92b-615d-4420-a603-e36ff39a7c40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28256", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01", "content": "", "creation_timestamp": "2026-03-12T11:00:00.000000Z"}, {"uuid": "578ca0a7-aad6-4f09-99cd-49027047b21c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28818", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "6cf5d649-988c-4ed8-a1e8-922d3e6c13eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28817", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "b3b29a2e-bea0-4bfe-a99b-e3a7e97ddb7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28816", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "8f660994-b7fd-45d8-9e6e-e6dc4edd25a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28828", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "2e9163f8-9008-4d7d-a1b5-a04840c82677", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28823", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "18bcd7c2-7513-47da-89de-9c11ec2cf911", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28822", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "07cd4cac-8c91-49a7-8f9c-bc9c20f383b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28821", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "9f07ac3c-9ba2-41ed-9dba-5f3ca111541d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28824", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "79c4953a-0a22-4ea0-bdee-e3b8bb4ecb3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28835", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "83c7abc3-1b87-460a-9abb-9007a07f8260", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28826", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "8c830929-64d0-4113-9c23-ee48ef06c766", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28825", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "7c773d76-5084-42b3-b998-a4dc7c827430", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28838", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "ff561dc7-d41b-41b1-ad24-4f478d9fb877", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28837", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "6303b872-c066-40eb-9963-001da720f65c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28356", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mguwj7ocuh2c", "content": "", "creation_timestamp": "2026-03-12T17:31:12.801062Z"}, {"uuid": "11c807ef-552c-42bf-a664-cdd6176e643c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28792", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mguwjgg63p2c", "content": "", "creation_timestamp": "2026-03-12T17:31:20.016739Z"}, {"uuid": "a48ebda0-39c4-49ef-a74e-079f8fb1e740", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28866", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "16d4c75b-5d89-4b28-80ad-b2f91991a206", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28895", "type": "seen", "source": "https://bsky.app/profile/juanky7274.bsky.social/post/3mhxbsxlgw727", "content": "", "creation_timestamp": "2026-03-26T09:24:01.947397Z"}, {"uuid": "f4a08061-bd59-4b0d-8ab7-4c0f120ccc0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28865", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "b10ee34b-a46e-4116-a188-19df5510f730", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28760", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhxbxx7c5m22", "content": "", "creation_timestamp": "2026-03-26T09:26:48.589326Z"}, {"uuid": "8dbb7ce7-ab05-4c33-9950-2fe628a4f6b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28792", "type": "seen", "source": "https://mastodon.social/ap/users/115755483699003887/statuses/116217391584830163", "content": "", "creation_timestamp": "2026-03-12T17:32:37.833709Z"}, {"uuid": "feaf4f6a-126c-4f59-a15e-ba7d8ffaa576", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28868", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "98f928ea-eec8-4811-95e5-a1b64c230ab4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28793", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mguwm4hwro2n", "content": "", "creation_timestamp": "2026-03-12T17:32:50.155987Z"}, {"uuid": "44121824-6f4a-404e-9565-d18503e14ffd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28833", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "e9eeafe7-91dc-4bb7-a772-1fe36c4c38f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28832", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "23cf0622-f4b7-4406-838b-5c1be92a5c25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28369", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mi34ntzpmc27", "content": "", "creation_timestamp": "2026-03-27T22:02:20.569151Z"}, {"uuid": "d96ed283-4615-4aa0-b1c2-078ec3c59ab6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28870", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "6f58c2e3-792f-4837-97ab-a2d97fc4d0e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28839", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "3f85f837-f38d-41de-b3ce-62412a2d140b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28829", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "307c6ea8-199b-4833-bc12-d0189972ed13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28841", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "958b012b-c99c-4e3b-b084-e68365d7d382", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28367", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mi35eyri5m2j", "content": "", "creation_timestamp": "2026-03-27T22:15:18.080780Z"}, {"uuid": "768c0939-c19e-43ee-b3dc-665b76116b43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28368", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mi35f7g5rs27", "content": "", "creation_timestamp": "2026-03-27T22:15:24.940197Z"}, {"uuid": "3c80f0f3-431f-42c1-904b-c3b974b746e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28368", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mi35faowni2k", "content": "", "creation_timestamp": "2026-03-27T22:15:25.886774Z"}, {"uuid": "3a5b2173-f43e-4a06-8d5c-ca56124052ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28292", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mguy553kyw2u", "content": "", "creation_timestamp": "2026-03-12T18:00:14.145946Z"}, {"uuid": "11d462f3-8296-4726-bb05-01c7eaf80e28", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28710", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgv3ifnu5t22", "content": "", "creation_timestamp": "2026-03-12T19:00:13.403283Z"}, {"uuid": "623d1b6c-254f-468f-a2d4-b636efe910b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28456", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhpif3r3zl24", "content": "", "creation_timestamp": "2026-03-23T07:00:14.216804Z"}, {"uuid": "f13767ba-aa1f-47f8-b97c-71542e1edd2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28864", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116288286319372700", "content": "", "creation_timestamp": "2026-03-25T06:00:32.148586Z"}, {"uuid": "8a7de9d4-8855-4b17-8ef8-ae96d43f6cb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28673", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhrzxneroh2b", "content": "", "creation_timestamp": "2026-03-24T07:20:10.008015Z"}, {"uuid": "f39914aa-b203-4c9d-a8d9-a26b81c12ba8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28864", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mhufy7vaxz2a", "content": "", "creation_timestamp": "2026-03-25T06:00:33.971420Z"}, {"uuid": "80b85f3d-625d-44f6-b3a8-c928103fa572", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28372", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mhpjzzchhz2r", "content": "", "creation_timestamp": "2026-03-23T07:29:50.368250Z"}, {"uuid": "446168b8-4003-47c8-a9be-ef9b966198c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28254", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgv4q7yz4v2o", "content": "", "creation_timestamp": "2026-03-12T19:22:29.777437Z"}, {"uuid": "9121c8a4-5bb8-4ee7-bfb4-c3074d7d9131", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28677", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhfiqrqllj2r", "content": "", "creation_timestamp": "2026-03-19T07:40:09.761921Z"}, {"uuid": "472fcd5b-f33a-4989-898e-93b04365c3b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28858", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116288365225347899", "content": "", "creation_timestamp": "2026-03-25T06:20:35.846390Z"}, {"uuid": "55b5903d-f0d2-4069-8145-b49a534e91a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28674", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhs33fhkkq2b", "content": "", "creation_timestamp": "2026-03-24T07:40:09.962782Z"}, {"uuid": "a5e21291-7eae-4b62-aa82-e0797fcbd957", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28831", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "6ce5594a-7d45-42e2-84de-f0a84cc743ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28256", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgv5cud77e2v", "content": "", "creation_timestamp": "2026-03-12T19:32:54.959029Z"}, {"uuid": "5b22ec18-bad9-47fc-9db3-f6d0fdd81422", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28842", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "70007615-9566-4236-96a0-62fb15a81e10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28292", "type": "seen", "source": "https://bsky.app/profile/g0rosato.bsky.social/post/3mhs3lbljwm2t", "content": "", "creation_timestamp": "2026-03-24T07:49:03.014696Z"}, {"uuid": "42625c42-73d0-43a7-b374-e3f849b3edb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28888", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260325", "content": "", "creation_timestamp": "2026-03-25T03:00:00.000000Z"}, {"uuid": "70db1232-3ba2-4658-b2cb-710bd0d60aef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28255", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgv5gpvyun2n", "content": "", "creation_timestamp": "2026-03-12T19:35:06.252789Z"}, {"uuid": "837f82ab-a981-466a-81a0-9b7e31c7dd3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28044", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhfjkmeeil2n", "content": "", "creation_timestamp": "2026-03-19T07:54:35.884732Z"}, {"uuid": "fb5e6f9e-21f0-4c12-9702-3e6f9f73c0e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28527", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mic4s34v4n2i", "content": "", "creation_timestamp": "2026-03-30T16:53:19.826882Z"}, {"uuid": "894e1644-425d-42e1-9526-4470ceb6c226", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28791", "type": "seen", "source": "https://gist.github.com/alon710/d73d499cf1d6e8d3c3762966f6b93ea2", "content": "", "creation_timestamp": "2026-03-12T19:40:05.000000Z"}, {"uuid": "c8d8432a-4bdc-4fc0-91da-5c302d84f110", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28070", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhfjty5rqv2n", "content": "", "creation_timestamp": "2026-03-19T07:59:50.181661Z"}, {"uuid": "d828e47b-43c5-4ecd-81eb-e74f19f302b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28528", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mic3obayys2j", "content": "", "creation_timestamp": "2026-03-30T16:33:18.433662Z"}, {"uuid": "cc743f7b-4bb9-4b93-af60-0845d172e062", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28526", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mic52zm2uf25", "content": "", "creation_timestamp": "2026-03-30T16:58:20.338368Z"}, {"uuid": "c7f43467-8d05-4aab-a7c9-8b396555c3cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28478", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mhbnszcr6o22", "content": "", "creation_timestamp": "2026-03-17T19:00:13.631386Z"}, {"uuid": "96e90c82-f2d1-4780-b165-41a90335edb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28864", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mi6h2aorys2g", "content": "", "creation_timestamp": "2026-03-29T05:46:14.088098Z"}, {"uuid": "14b82b7a-d859-490d-9e74-f32f010c946d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28252", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgv6wxacgr27", "content": "", "creation_timestamp": "2026-03-12T20:02:06.594016Z"}, {"uuid": "563e1cb1-2665-4fc1-b715-838506f4a95e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28217", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mhqeeeduqr2w", "content": "", "creation_timestamp": "2026-03-23T15:20:54.382301Z"}, {"uuid": "258f4a4c-7dc0-43ee-ac43-29a30ae6598a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28217", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116279164131270309", "content": "", "creation_timestamp": "2026-03-23T15:20:38.572841Z"}, {"uuid": "620bfb38-ffa1-4d72-8736-6e3f40bd2834", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28787", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mho3ogk66x24", "content": "", "creation_timestamp": "2026-03-22T17:40:09.315901Z"}, {"uuid": "15146813-9fa2-4baa-be45-836a8e426294", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28356", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mgv7eod5rta2", "content": "", "creation_timestamp": "2026-03-12T20:09:48.487937Z"}, {"uuid": "c3466c65-bc8d-41df-985e-536be7108bce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28073", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mhfl7mlnc224", "content": "", "creation_timestamp": "2026-03-19T08:24:14.246747Z"}, {"uuid": "6b137ee5-b40e-43ea-90bb-3a7505bdbab7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28484", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-openclaws-nextcloud-talk-plugin-patch", "content": "", "creation_timestamp": "2026-03-06T18:36:12.000000Z"}, {"uuid": "bc81f13b-0168-4624-a91a-7153f6a19431", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28470", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-openclaws-nextcloud-talk-plugin-patch", "content": "", "creation_timestamp": "2026-03-06T18:36:12.000000Z"}, {"uuid": "1df843f1-0136-4f9f-9214-ff5dd32271ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28472", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-openclaws-nextcloud-talk-plugin-patch", "content": "", "creation_timestamp": "2026-03-06T18:36:12.000000Z"}, {"uuid": "817e108b-b3a1-4c2b-886a-dbd97321f568", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28466", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-openclaws-nextcloud-talk-plugin-patch", "content": "", "creation_timestamp": "2026-03-06T18:36:12.000000Z"}, {"uuid": "8dffa192-3cf3-43ba-b683-9b58d46caccd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28391", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-openclaws-nextcloud-talk-plugin-patch", "content": "", "creation_timestamp": "2026-03-06T18:36:12.000000Z"}, {"uuid": "2ae46c47-21ea-487d-a365-bbb4aaa0dc01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28474", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-openclaws-nextcloud-talk-plugin-patch", "content": "", "creation_timestamp": "2026-03-06T18:36:12.000000Z"}, {"uuid": "1b8efaa8-5f3a-4416-b159-58d9dfbf1153", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28500", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mhlwbm6xgw2q", "content": "", "creation_timestamp": "2026-03-21T20:58:10.706689Z"}, {"uuid": "f34cfd60-4064-47de-97c9-050c0320a4b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28446", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-multiple-critical-vulnerabilities-openclaws-nextcloud-talk-plugin-patch", "content": "", "creation_timestamp": "2026-03-06T18:36:12.000000Z"}, {"uuid": "ed206c35-0ff9-41a2-aea7-18529bbe468a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28292", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mgv7xcv3pk2i", "content": "", "creation_timestamp": "2026-03-12T20:20:08.821028Z"}, {"uuid": "2c4aa405-e65e-41ca-8130-ea609b21c70a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28253", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mgva2ugkpi2z", "content": "", "creation_timestamp": "2026-03-12T20:22:08.334002Z"}, {"uuid": "d8cf1c19-7a8a-444d-b1f3-4427a98ed689", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28864", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mi6rvbymxk2g", "content": "", "creation_timestamp": "2026-03-29T09:00:18.525596Z"}, {"uuid": "18890ca6-6cc6-4f88-8fe1-aa3533356c12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28877", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mi6rvbymxk2g", "content": "", "creation_timestamp": "2026-03-29T09:00:18.597984Z"}, {"uuid": "7d9eb1c8-7dbb-474d-bf81-9b249c0b8d86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28823", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mi6rvbymxk2g", "content": "", "creation_timestamp": "2026-03-29T09:00:18.693788Z"}, {"uuid": "a4af58be-4693-4241-a9f5-58ea6c0933a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28228", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3micnzyxr272r", "content": "", "creation_timestamp": "2026-03-30T22:02:00.125823Z"}, {"uuid": "90b233c1-1685-4aa2-aa86-abe6892c530a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28414", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-28414.yaml", "content": "", "creation_timestamp": "2026-03-31T04:03:14.000000Z"}, {"uuid": "52553230-953d-49ae-8dca-6baa080ea7b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28369", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mifdyha5xi27", "content": "", "creation_timestamp": "2026-03-31T23:40:09.573419Z"}, {"uuid": "06c5a50d-566f-452a-bcae-ecc2e816d1d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28368", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3miff4esi2e2q", "content": "", "creation_timestamp": "2026-04-01T00:00:15.205853Z"}, {"uuid": "2f50827f-9e4a-482c-b27f-087ad1610e12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28377", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mifvusmiti2c", "content": "", "creation_timestamp": "2026-04-01T05:00:14.347451Z"}, {"uuid": "f8222187-9dea-427b-8805-5a4a83794508", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/freescout_htaccess_rce.rb", "content": "", "creation_timestamp": "2026-03-31T16:18:43.000000Z"}, {"uuid": "bb2a90a8-883f-46bf-a158-0e646923b191", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28414", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mihlnmxelz2q", "content": "", "creation_timestamp": "2026-04-01T21:02:39.836926Z"}, {"uuid": "772f1e5c-d7b9-40f1-a823-0241a8c206c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28421", "type": "seen", "source": "https://gist.github.com/sgInnora/1881b930d06973834faf1f59e2e2e2ac", "content": "", "creation_timestamp": "2026-04-02T07:35:25.000000Z"}, {"uuid": "ab998c71-023e-4084-bc01-6fd56f271050", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28420", "type": "seen", "source": "https://gist.github.com/sgInnora/1881b930d06973834faf1f59e2e2e2ac", "content": "", "creation_timestamp": "2026-04-02T07:35:25.000000Z"}, {"uuid": "8f2bd30a-8001-45f9-acdc-4b4cd18d9aa2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28805", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mijny2n5o527", "content": "", "creation_timestamp": "2026-04-02T16:49:32.506961Z"}, {"uuid": "9453d164-7516-4ea9-bdba-a75be21f2d5e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28228", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mijwfesxdt2v", "content": "", "creation_timestamp": "2026-04-02T19:20:09.307292Z"}, {"uuid": "476f6dd4-9cc5-4c91-a811-823270b4efb0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28358", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-28358.yaml", "content": "", "creation_timestamp": "2026-04-02T04:59:00.000000Z"}, {"uuid": "e8a22769-84d0-4066-a09e-9fcf349f62c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28815", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mikulke5wj2d", "content": "", "creation_timestamp": "2026-04-03T04:20:28.740780Z"}, {"uuid": "f2b08766-ab8d-4e5a-a8cd-6761553555ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28756", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3milocanjqh24", "content": "", "creation_timestamp": "2026-04-03T12:00:33.676878Z"}, {"uuid": "58dfb3cb-159b-4af3-b026-561e9a65ac60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28754", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3milol72t272o", "content": "", "creation_timestamp": "2026-04-03T12:05:34.188343Z"}, {"uuid": "d04c354f-4a9d-4176-a76b-45051f4b8769", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28754", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3milr7sa34t26", "content": "", "creation_timestamp": "2026-04-03T12:52:53.177923Z"}, {"uuid": "d6e596db-7ca9-4924-837a-037a8a871d2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28756", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3milrayuqdt2g", "content": "", "creation_timestamp": "2026-04-03T12:53:33.328493Z"}, {"uuid": "fa35d77f-ea59-4c20-af2e-9e73753ff308", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28703", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3milrcr5y3m2o", "content": "", "creation_timestamp": "2026-04-03T12:54:32.492497Z"}, {"uuid": "0104e5f6-2f42-4d4a-a746-57983467e0ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28373", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mimf7vkynz23", "content": "", "creation_timestamp": "2026-04-03T18:50:51.154942Z"}, {"uuid": "204b29c8-3da7-4d6b-a008-66c8e74d8d4e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28766", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mims662mkg2s", "content": "", "creation_timestamp": "2026-04-03T22:42:31.439594Z"}, {"uuid": "5240758a-2326-44c8-8e8b-ffd7671234e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28798", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mimso43jq22q", "content": "", "creation_timestamp": "2026-04-03T22:51:26.370838Z"}, {"uuid": "f88278c7-4321-40aa-ac1b-f8171a2c9a30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28797", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mimvgajrpe23", "content": "", "creation_timestamp": "2026-04-03T23:40:43.833634Z"}, {"uuid": "d732c163-4fbd-44ef-8c16-0860412c65e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28754", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mindwb2xho2v", "content": "", "creation_timestamp": "2026-04-04T04:00:15.955379Z"}, {"uuid": "377097e8-dcbb-436d-9451-03cc65c780c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28766", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mindxidzlo2s", "content": "", "creation_timestamp": "2026-04-04T04:00:55.376315Z"}, {"uuid": "fb4bd94f-6780-4ee4-8cdc-7b1bf7646711", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28798", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3minejwkyoe2k", "content": "", "creation_timestamp": "2026-04-04T04:11:14.072010Z"}, {"uuid": "d600b1bc-2aa5-4e68-9900-b7b27f147376", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28798", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mini3mv36v2c", "content": "", "creation_timestamp": "2026-04-04T05:14:52.041416Z"}, {"uuid": "9ff17b69-947a-4c3e-b2cd-d4ac026b7102", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28373", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3minknc53dd27", "content": "", "creation_timestamp": "2026-04-04T06:00:29.272190Z"}, {"uuid": "5623dd95-63a2-4607-a566-4966903bac7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28815", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3minnymsinw2p", "content": "", "creation_timestamp": "2026-04-04T07:00:31.152445Z"}, {"uuid": "3b116191-4955-4c3f-8983-c430ce1a0595", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2826", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mioalf7ap52i", "content": "", "creation_timestamp": "2026-04-04T12:33:07.623774Z"}, {"uuid": "1e026947-3f82-4ed1-8d7d-5f94c3815e82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28756", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mipmkpabgu2v", "content": "", "creation_timestamp": "2026-04-05T01:40:09.538360Z"}, {"uuid": "1b763056-fd87-4d14-9b2f-01259d19ddfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28805", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3miptsgy52h2w", "content": "", "creation_timestamp": "2026-04-05T03:49:45.354202Z"}, {"uuid": "10ff7908-e4f6-4194-bfa1-28e7661d9e5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28805", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mipv5mwumi2x", "content": "", "creation_timestamp": "2026-04-05T04:13:54.395403Z"}, {"uuid": "05276b98-619f-4c56-aa73-13165d73f5d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28797", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3miv7ewquej27", "content": "", "creation_timestamp": "2026-04-07T07:00:16.429442Z"}, {"uuid": "fc6e08f4-09d0-4c10-8b6b-d4dbc8f6cc6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28797", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3miv7eyfqu42e", "content": "", "creation_timestamp": "2026-04-07T07:00:22.859082Z"}, {"uuid": "c3c22020-6425-4cbf-8f4f-7b0f571923bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28810", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mivk27bqdq2t", "content": "", "creation_timestamp": "2026-04-07T10:11:07.295043Z"}, {"uuid": "dd6152db-c0c6-4782-a904-245a33bbf705", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28808", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miw4uon3zm24", "content": "", "creation_timestamp": "2026-04-07T15:48:05.987015Z"}, {"uuid": "7d784862-ed35-4abc-adc2-13ce2aab6d17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28386", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3miwwr7vxwk2o", "content": "", "creation_timestamp": "2026-04-07T23:31:26.892236Z"}, {"uuid": "cae9470a-086d-4aa0-ad4a-89abee9df0e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28387", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3miwwr7vxwk2o", "content": "", "creation_timestamp": "2026-04-07T23:31:26.977160Z"}, {"uuid": "1b8feeb2-62d5-4ff5-be9c-eee7d781eb30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28388", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3miwwr7vxwk2o", "content": "", "creation_timestamp": "2026-04-07T23:31:27.063187Z"}, {"uuid": "27c81398-87a3-4a17-91c9-08e39269fbe6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28389", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3miwwr7vxwk2o", "content": "", "creation_timestamp": "2026-04-07T23:31:27.156524Z"}, {"uuid": "1ad70634-e52f-479b-9c12-905520222966", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28390", "type": "seen", "source": "https://bsky.app/profile/omo.bsky.social/post/3miwwr7vxwk2o", "content": "", "creation_timestamp": "2026-04-07T23:31:27.243103Z"}, {"uuid": "c8a81993-d011-4d84-8dcd-a50391176478", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28755", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0376/", "content": "", "creation_timestamp": "2026-03-29T17:00:00.000000Z"}, {"uuid": "5a8ac593-82a1-44a1-8f97-2d09122b0b03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28858", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-013/", "content": "", "creation_timestamp": "2026-03-29T17:00:00.000000Z"}, {"uuid": "3a3c3661-0c26-4915-998a-9518782c0237", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28753", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0376/", "content": "", "creation_timestamp": "2026-03-29T17:00:00.000000Z"}, {"uuid": "7b1b4fa2-b49b-48c1-9412-79b79c61fec6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28827", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-013/", "content": "", "creation_timestamp": "2026-03-29T17:00:00.000000Z"}, {"uuid": "363c1b83-6edf-40dd-8498-8b3507e0636f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://t.me/true_secator/8137", "content": "Apple \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0432\u043d\u0435\u043f\u043b\u0430\u043d\u043e\u0432\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 iPhone \u0438 iPad \u0434\u043b\u044f \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0441\u043b\u0443\u0436\u0431\u0435 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f\u043c, \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u043c \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f, \u043e\u0441\u0442\u0430\u0432\u0430\u0442\u044c\u0441\u044f \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-28950 \u0438 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 22 \u0430\u043f\u0440\u0435\u043b\u044f 2026 \u0433\u043e\u0434\u0430 \u0432 iOS 26.4.2 \u0438 iPadOS 26.4.2, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0432 iOS 18.7.8 \u0438 iPadOS 18.7.8.\n\nApple \u043e\u0442\u043c\u0435\u0442\u0438\u043b\u0430, \u0447\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0437\u0430 \u0441\u0447\u0435\u0442 \u0443\u043b\u0443\u0447\u0448\u0435\u043d\u0438\u044f \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445, \u043d\u043e \u043d\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043f\u0440\u0438 \u044d\u0442\u043e\u043c \u043d\u0438\u043a\u0430\u043a\u043e\u0439 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u043d\u0435 \u043f\u043e\u044f\u0441\u043d\u0438\u043b\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u043b\u0438 \u044d\u0442\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u0430\u0442\u0430\u043a\u0430\u0445 \u0438\u043b\u0438 \u043f\u043e\u0447\u0435\u043c\u0443 \u043e\u043d\u0430 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432\u043d\u0435 \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e \u0446\u0438\u043a\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\nApple \u0442\u0430\u043a\u0436\u0435 \u043d\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439 \u043e \u0442\u043e\u043c, \u043a\u0430\u043a \u0434\u043e\u043b\u0433\u043e \u0434\u0430\u043d\u043d\u044b\u0435 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u043e\u0441\u0442\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u0438\u043b\u0438 \u043a\u0430\u043a \u0438\u0445 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u043d\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c.\n\n\u0412\u043c\u0435\u0441\u0442\u0435 \u0441 \u0442\u0435\u043c, \u0441\u043e\u0432\u0441\u0435\u043c \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0436\u0443\u0440\u043d\u0430\u043b\u0438\u0441\u0442\u044b \u043e\u0431\u043e\u0437\u0440\u0435\u0432\u0430\u043b\u0438, \u043a\u0430\u043a \u0430\u0433\u0435\u043d\u0442\u0430\u043c \u0424\u0411\u0420 \u0421\u0428\u0410 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043a\u043e\u043f\u0438\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 Signal \u043d\u0430 iPhone \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u0435\u043c\u043e\u0433\u043e, \u0434\u0430\u0436\u0435 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u043e\u043d\u0438 \u0431\u044b\u043b\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u044b \u0438\u0437 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f.\n\n\u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430\u043c \u0441\u0443\u0434\u0435\u0431\u043d\u043e\u0433\u043e \u0437\u0430\u0441\u0435\u0434\u0430\u043d\u0438\u044f, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0431\u0432\u0438\u043d\u044f\u0435\u043c\u044b\u0445, \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0431\u044b\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u044b \u043d\u0435 \u0438\u0437 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 Signal, \u0430 \u0438\u0437 \u043f\u0430\u043c\u044f\u0442\u0438 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 iPhone.\n\n\u041a\u0430\u043a \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442\u0441\u044f, \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0438 \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u044b \u0441 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u0430 \u043e\u0431\u0432\u0438\u043d\u044f\u0435\u043c\u043e\u0433\u043e \u0447\u0435\u0440\u0435\u0437 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u043f\u0430\u043c\u044f\u0442\u044c \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 Apple, \u043f\u0440\u0438\u0447\u0435\u043c \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 Signal \u0431\u044b\u043b\u043e \u0443\u0434\u0430\u043b\u0435\u043d\u043e, \u043d\u043e \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0441\u044c \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043f\u0430\u043c\u044f\u0442\u0438.\n\n\u0412 Signal \u0432\u044b\u0441\u043e\u043a\u043e \u043e\u0446\u0435\u043d\u0438\u043b\u0438 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u0443\u044e \u0440\u0435\u0430\u043a\u0446\u0438\u044e Apple \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u043b\u0430 \u0443\u0433\u0440\u043e\u0437\u0443 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u0432\u0441\u0435\u0445 \u0447\u0430\u0441\u0442\u043d\u044b\u0445 \u0440\u0430\u0437\u0433\u043e\u0432\u043e\u0440\u043e\u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.\n\n\u0412 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0438 Apple \u044d\u0442\u043e\u0442 \u0441\u043b\u0443\u0447\u0430\u0439 \u043d\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442\u0441\u044f, \u043d\u043e \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435 \u043e\u0447\u0435\u043d\u044c \u0442\u043e\u0447\u043d\u043e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 \u0442\u0438\u043f\u0443 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445, \u043e\u043f\u0438\u0441\u0430\u043d\u043d\u043e\u043c\u0443 \u0432 \u0442\u043e\u043c \u043e\u0442\u0447\u0435\u0442\u0435.\n\n\u0422\u0430\u043a \u0447\u0442\u043e \u0432\u0441\u0435\u043c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u044f\u0431\u043b\u043e\u0447\u043d\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043d\u0430\u043a\u0430\u0442\u0438\u0442\u044c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f, \u0434\u0430\u0431\u044b \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0442\u0438\u0442\u044c  \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u043d\u0435\u0436\u0435\u043b\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u043d\u0430 \u0438\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445.", "creation_timestamp": "2026-04-23T18:00:08.000000Z"}, {"uuid": "9e416c5a-c5fe-4e67-8c06-2831a0480a63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28386", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3miyb6guojc23", "content": "", "creation_timestamp": "2026-04-08T12:10:23.963673Z"}, {"uuid": "7e939c20-4e96-4225-84b9-2c9194b13908", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28387", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3miyb6guojc23", "content": "", "creation_timestamp": "2026-04-08T12:10:24.104272Z"}, {"uuid": "0220b143-9f14-4517-ab64-76cf5b08810d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28388", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3miyb6guojc23", "content": "", "creation_timestamp": "2026-04-08T12:10:24.192086Z"}, {"uuid": "fa54360f-f762-4588-ba72-9b1084443527", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28389", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3miyb6guojc23", "content": "", "creation_timestamp": "2026-04-08T12:10:24.288450Z"}, {"uuid": "d993fcd3-374e-4853-a432-27ed7ed49cec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28390", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3miyb6guojc23", "content": "", "creation_timestamp": "2026-04-08T12:10:24.378472Z"}, {"uuid": "dffb752a-57ea-4db3-93f3-0f2177e68770", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28264", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miyjbaoxui2z", "content": "", "creation_timestamp": "2026-04-08T14:35:08.205954Z"}, {"uuid": "672b5ace-509a-4404-9138-639da6a7e77a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28261", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3miykrrqyr42i", "content": "", "creation_timestamp": "2026-04-08T15:02:16.573802Z"}, {"uuid": "3fc208a7-eb00-42b0-a8f7-edf69de3c0e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28261", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3miyowc36ju2n", "content": "", "creation_timestamp": "2026-04-08T16:16:23.110334Z"}, {"uuid": "e17d311f-296f-41dc-b86a-8c66b169940a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28261", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-28261", "content": "", "creation_timestamp": "2026-04-08T04:16:41.000000Z"}, {"uuid": "aca6eef8-98f9-41e0-80ad-56aa1ef2add5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28387", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mizivgtbk72n", "content": "", "creation_timestamp": "2026-04-09T00:01:12.453033Z"}, {"uuid": "aff4ad5d-fbf5-4e38-9bcd-cf7c11d7c6f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28388", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mizivgtbk72n", "content": "", "creation_timestamp": "2026-04-09T00:01:12.573684Z"}, {"uuid": "cc2c6bb5-7448-4a72-9671-40d1b40466f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28389", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mizivgtbk72n", "content": "", "creation_timestamp": "2026-04-09T00:01:14.948794Z"}, {"uuid": "b2090be0-9e1b-43c0-bac1-8571b189359b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28390", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mizivgtbk72n", "content": "", "creation_timestamp": "2026-04-09T00:01:15.052967Z"}, {"uuid": "b4c3e784-a01b-4aaa-bb73-0de44075d9af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28387", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mizivhunpd2e", "content": "", "creation_timestamp": "2026-04-09T00:01:16.130367Z"}, {"uuid": "d33ca3a7-72eb-4bb6-b5b2-93067c96d38c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28388", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3mizivhunpd2e", "content": "", "creation_timestamp": "2026-04-09T00:01:16.230317Z"}, {"uuid": "a259f8bf-60e0-41e5-adfe-f2c6405cbc93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28389", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3miziviw47p2n", "content": "", "creation_timestamp": "2026-04-09T00:01:17.406039Z"}, {"uuid": "13231c25-d34a-463b-92ee-4deaa5ab45f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28390", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3miziviw47p2n", "content": "", "creation_timestamp": "2026-04-09T00:01:17.509989Z"}, {"uuid": "7dec24a9-7735-4ca1-bd2c-ffcc65e724bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28264", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mizr665myz26", "content": "", "creation_timestamp": "2026-04-09T02:29:14.866403Z"}, {"uuid": "79e004d4-451e-4894-96e1-8a58f0c1ff21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28704", "type": "seen", "source": "https://jvn.jp/en/jp/JVN00263243/", "content": "", "creation_timestamp": "2026-04-09T21:15:00.000000Z"}, {"uuid": "d15e210c-7ede-4056-b414-df46156e946a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28261", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mj2ketlv2w2r", "content": "", "creation_timestamp": "2026-04-09T10:00:22.347805Z"}, {"uuid": "debcad4d-719d-474d-88b7-8ae25a3831a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28205", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mj3pjao2lj2z", "content": "", "creation_timestamp": "2026-04-09T21:04:58.295467Z"}, {"uuid": "d4ce2cde-55da-46b6-8b18-63fb083472ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28704", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mj4rr3mnti27", "content": "", "creation_timestamp": "2026-04-10T07:17:49.135252Z"}, {"uuid": "6e1f6335-f2a4-41a0-bb1e-277dad758b17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28704", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mj4xmy4a7z23", "content": "", "creation_timestamp": "2026-04-10T09:02:53.327497Z"}, {"uuid": "db76c29f-a94a-4846-8010-e35835711ed0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28367", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mj5lycpyck23", "content": "", "creation_timestamp": "2026-04-10T15:07:08.110894Z"}, {"uuid": "aecc2fdc-2996-4038-99d4-7eac050d67b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28501", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mj67uspwed2f", "content": "", "creation_timestamp": "2026-04-10T21:03:15.845247Z"}, {"uuid": "be804f48-cee8-4cf9-a877-10f0e26454be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2826", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mj6i3pigaf2b", "content": "", "creation_timestamp": "2026-04-10T23:30:07.017875Z"}, {"uuid": "13c5ad56-3c01-42ae-b9f7-9857dc8089a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28704", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mjee242wzs2v", "content": "", "creation_timestamp": "2026-04-13T07:33:38.343063Z"}, {"uuid": "bd2858c4-7a6e-4e78-b520-dfde2de31f15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28291", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mjfi5dfcmd2w", "content": "", "creation_timestamp": "2026-04-13T18:19:40.050368Z"}, {"uuid": "9eabd32f-58ae-4d67-9745-d77c291382a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28261", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mjg5abogxq2j", "content": "", "creation_timestamp": "2026-04-14T00:37:08.413789Z"}, {"uuid": "e2bb725d-40cf-4808-82bf-a3019395404d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28387", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mjhdh76yv42c", "content": "", "creation_timestamp": "2026-04-14T12:01:01.748109Z"}, {"uuid": "d78b38e2-1a3c-49e6-8f6b-e2f5a601b880", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28388", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mjhdharuzz2n", "content": "", "creation_timestamp": "2026-04-14T12:01:03.823193Z"}, {"uuid": "52ac4a6e-b2e4-4fe7-be11-6df615ddc58e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28389", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mjhdhbtrl42x", "content": "", "creation_timestamp": "2026-04-14T12:01:04.542837Z"}, {"uuid": "73d1d252-6f21-4b89-b95e-2daaaad5e2db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28390", "type": "seen", "source": "https://bsky.app/profile/lambdawatchdog.bsky.social/post/3mjhdhdcjum2c", "content": "", "creation_timestamp": "2026-04-14T12:01:06.444622Z"}, {"uuid": "f328bfb0-5132-4910-ad2f-07c2b2c6b069", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2834", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjj4n6s5yj2k", "content": "", "creation_timestamp": "2026-04-15T05:04:26.149645Z"}, {"uuid": "36dcdf0d-204e-4474-a7b6-d35307f26227", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28515", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/opendcim_install_sqli_rce.rb", "content": "", "creation_timestamp": "2026-04-14T20:15:55.000000Z"}, {"uuid": "8e720749-78d6-4a29-9c39-642b3effdf30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28516", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/opendcim_install_sqli_rce.rb", "content": "", "creation_timestamp": "2026-04-14T20:15:55.000000Z"}, {"uuid": "25211b57-2332-4428-a519-dc62933f38cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28517", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/opendcim_install_sqli_rce.rb", "content": "", "creation_timestamp": "2026-04-14T20:15:55.000000Z"}, {"uuid": "5d737c22-02f5-4839-a17b-3307ac83e694", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28741", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjjudayl732o", "content": "", "creation_timestamp": "2026-04-15T12:08:22.393999Z"}, {"uuid": "45c43753-7140-45e9-bafc-c5861099f543", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28515", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mjks6jvlf22m", "content": "", "creation_timestamp": "2026-04-15T21:02:39.624075Z"}, {"uuid": "9ef09b19-0b5a-4542-834f-a1f6481dcb09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28516", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mjks6jy6wf2z", "content": "", "creation_timestamp": "2026-04-15T21:02:40.348497Z"}, {"uuid": "858a98c9-73da-4e16-81f0-bcbc61afebd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28517", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mjks6k2s4z26", "content": "", "creation_timestamp": "2026-04-15T21:02:40.913272Z"}, {"uuid": "b4c027fc-c975-4532-a45f-9b2f7967af25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28741", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mjmcwqgahd2b", "content": "", "creation_timestamp": "2026-04-16T11:35:11.060509Z"}, {"uuid": "60d8f9cd-2ee2-48f5-823b-2dbf08653ddf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28268", "type": "seen", "source": "https://bsky.app/profile/vikunja.io/post/3mjosv5erzc2a", "content": "", "creation_timestamp": "2026-04-17T11:25:54.565712Z"}, {"uuid": "e329def1-7edd-4130-a9d9-d9c24c84c1f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28268", "type": "seen", "source": "https://bsky.app/profile/vikunja.io/post/3mjosv5eyu22a", "content": "", "creation_timestamp": "2026-04-17T11:26:04.953459Z"}, {"uuid": "b6310e31-8d5d-4013-96ff-3b64f171f6cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28268", "type": "seen", "source": "https://bsky.app/profile/vikunja.io/post/3mjosv5eztc2a", "content": "", "creation_timestamp": "2026-04-17T11:26:05.543245Z"}, {"uuid": "200a311e-1c5a-4412-ab15-ce5870c29d3f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28268", "type": "seen", "source": "https://bsky.app/profile/vikunja.io/post/3mjosv5f3rs2a", "content": "", "creation_timestamp": "2026-04-17T11:26:06.095257Z"}, {"uuid": "b7f6662b-6a57-43f9-b6f8-ee11df6e282f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28268", "type": "seen", "source": "https://bsky.app/profile/vikunja.io/post/3mjosv5f4r22a", "content": "", "creation_timestamp": "2026-04-17T11:26:06.615748Z"}, {"uuid": "d1d76973-2643-4a7c-b318-39aa43ec32f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28263", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mjp43jitpo23", "content": "", "creation_timestamp": "2026-04-17T14:10:34.904920Z"}, {"uuid": "47d73632-7519-48b7-aa3d-abbcaf00edc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28212", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mjpngjfoyb26", "content": "", "creation_timestamp": "2026-04-17T19:20:55.838862Z"}, {"uuid": "2a19bb33-9738-4558-bcf9-5af09c95f4a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28224", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mjppn74kwq2i", "content": "", "creation_timestamp": "2026-04-17T20:00:26.337945Z"}, {"uuid": "c7327a84-f4b6-4c52-beaa-611d1e77bd53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28212", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mjpvde6jxx2v", "content": "", "creation_timestamp": "2026-04-17T21:42:17.775701Z"}, {"uuid": "40335ef7-5ec9-4dc4-8dca-3efbb166dfcc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28518", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mjqktigl4h2t", "content": "", "creation_timestamp": "2026-04-18T04:07:08.782182Z"}, {"uuid": "a164cb6f-f0d0-4e15-9155-7a33fd5d0c73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28390", "type": "seen", "source": "https://bsky.app/profile/releaseport.com/post/3mjv2velegq2t", "content": "", "creation_timestamp": "2026-04-19T23:05:10.103848Z"}, {"uuid": "854f77b2-35b3-46c6-b4c1-581cef6f1b0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28737", "type": "seen", "source": "https://bsky.app/profile/vmorecloud.bsky.social/post/3mjvoyk7fjb2y", "content": "", "creation_timestamp": "2026-04-20T05:04:51.250631Z"}, {"uuid": "bd0faf20-d99f-4b89-a163-113ba9212c2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28229", "type": "seen", "source": "https://gist.github.com/macaugh/87b48d5dea45643c2327ffefc41fa781", "content": "", "creation_timestamp": "2026-04-22T05:14:22.000000Z"}, {"uuid": "6e4ab752-d04e-4677-bda9-c9a2024480c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28229", "type": "seen", "source": "https://gist.github.com/macaugh/60e2e3bef2a42de7485469d4c735428a", "content": "", "creation_timestamp": "2026-04-22T05:15:04.000000Z"}, {"uuid": "8a391675-e6db-4c29-93f2-bddd5e4d4b65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28229", "type": "seen", "source": "https://gist.github.com/macaugh/366040b1b3ca14745bf144452be3c243", "content": "", "creation_timestamp": "2026-04-22T05:18:19.000000Z"}, {"uuid": "2e88a8b7-778f-4b63-a117-336e7f1844f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28229", "type": "seen", "source": "https://gist.github.com/macaugh/b8005d8904708d5d7d7eb2ad08aa0ef9", "content": "", "creation_timestamp": "2026-04-22T05:30:28.000000Z"}, {"uuid": "4641b782-3757-45b0-bb2e-8388fa9f8ca1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28229", "type": "seen", "source": "https://gist.github.com/macaugh/08eeb15089e6caad523605cd7b8c40ba", "content": "", "creation_timestamp": "2026-04-22T06:07:11.000000Z"}, {"uuid": "d8fca50d-db52-4f71-aab0-ccd9f047d910", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28386", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/116449675412278045", "content": "", "creation_timestamp": "2026-04-22T18:03:54.085759Z"}, {"uuid": "dad7d06f-8294-412d-b797-1b45d0683f9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://infosec.exchange/users/wdormann/statuses/116449741298473755", "content": "", "creation_timestamp": "2026-04-22T18:20:39.948205Z"}, {"uuid": "df127e7c-dbde-47d5-aa6e-77eb5cf50ec0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/wdormann.infosec.exchange.ap.brid.gy/post/3mk44fk3lhqz2", "content": "", "creation_timestamp": "2026-04-22T18:20:45.128403Z"}, {"uuid": "2fc641ad-e08d-4da2-9ce3-e9204664383d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28766", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mk46yinlfd25", "content": "", "creation_timestamp": "2026-04-22T19:07:08.117398Z"}, {"uuid": "5324d0a3-63e3-4f37-b4ac-d977b2e3f4dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28390", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mk4bc7rm3k2e", "content": "", "creation_timestamp": "2026-04-22T19:48:24.010585Z"}, {"uuid": "d9d4d684-fa49-44d2-a861-73d2e6ce1818", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28229", "type": "seen", "source": "https://gist.github.com/macaugh/2dbef9511d8f3c222b723fac8d04179d", "content": "", "creation_timestamp": "2026-04-22T20:58:48.000000Z"}, {"uuid": "f70da48d-b458-4fd0-8d6f-8a85e332b11e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28409", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3mk4fgtfgcb2i", "content": "", "creation_timestamp": "2026-04-22T21:02:35.120821Z"}, {"uuid": "c635ac40-7eb9-423e-8fd1-1b995f7e6fe9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mk4q7qetkj2y", "content": "", "creation_timestamp": "2026-04-23T00:15:24.579207Z"}, {"uuid": "f0aeb2fe-6bfa-4cea-a277-65edde66992f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28950", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mk5eqdqoqd2d", "content": "", "creation_timestamp": "2026-04-23T06:22:36.729460Z"}, {"uuid": "162d76f1-bc85-472d-a52a-c3978c0c0ef0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mk5nairq642z", "content": "", "creation_timestamp": "2026-04-23T08:54:49.023868Z"}, {"uuid": "cd29ac9d-bec5-40f1-a187-dfa78a908822", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://thehackernews.com/2026/04/apple-patches-ios-flaw-that-stored.html", "content": "", "creation_timestamp": "2026-04-23T06:06:00.000000Z"}, {"uuid": "d503cc90-2aa1-4ea5-9055-0f8f74671739", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mk5rqm2l752q", "content": "", "creation_timestamp": "2026-04-23T10:15:23.746725Z"}, {"uuid": "2328f421-5c43-440d-af2d-c26cb1119c9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mk5rzargxt2a", "content": "", "creation_timestamp": "2026-04-23T10:20:14.162219Z"}, {"uuid": "391e512c-aad5-4839-9d2d-105b9b46efda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mk5vgp5y5l27", "content": "", "creation_timestamp": "2026-04-23T11:21:26.875486Z"}, {"uuid": "e0031577-bf1c-4e34-8063-046bf080752c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mk5vmu7dts2n", "content": "", "creation_timestamp": "2026-04-23T11:24:56.718748Z"}, {"uuid": "f16681a8-1f7e-4eb8-b3a2-3edfdb61187f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28825", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mk5vqglkqz2o", "content": "", "creation_timestamp": "2026-04-23T11:26:52.785342Z"}, {"uuid": "71fa7d47-a4db-42c1-b619-6960aa5b7cce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/buchikuma.bsky.social/post/3mk5xgipybs23", "content": "", "creation_timestamp": "2026-04-23T11:57:07.005252Z"}, {"uuid": "82243af3-6695-40fa-8fcd-445a98afc1be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://infosec.exchange/users/technadu/statuses/116454191858418367", "content": "", "creation_timestamp": "2026-04-23T13:12:30.269923Z"}, {"uuid": "6182822b-ce32-4d4f-aec2-87f1c76ff3d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28387", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mk675fasgt2h", "content": "", "creation_timestamp": "2026-04-23T14:15:11.476799Z"}, {"uuid": "8ceb6aa0-93dd-49dc-a740-d65cd91eb88e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mk67ggu4jz2e", "content": "", "creation_timestamp": "2026-04-23T14:20:15.190114Z"}, {"uuid": "cc77438b-c9d8-45aa-b76b-97733a0a307b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28747", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-113-03", "content": "", "creation_timestamp": "2026-04-23T05:00:00.000000Z"}, {"uuid": "fa53ba2a-e892-4e44-8028-b30c638dd2c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28390", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mk6jwagxpk2b", "content": "", "creation_timestamp": "2026-04-23T17:28:05.316684Z"}, {"uuid": "dd6d2942-07f3-456d-ad00-433346905968", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mk6mr47cwo2c", "content": "", "creation_timestamp": "2026-04-23T18:18:52.251489Z"}, {"uuid": "b832a30a-f56a-4f76-9822-206211e60c0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/sctocs.bsky.social/post/3mk6riwjlic2n", "content": "", "creation_timestamp": "2026-04-23T19:43:48.167049Z"}, {"uuid": "2c527d8d-fa2d-4113-b5a8-60d3c965c52a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/intel.overresearched.net/post/3mk6uct7d7k2q", "content": "", "creation_timestamp": "2026-04-23T20:34:05.274459Z"}, {"uuid": "5a86c2e8-7ddf-4e47-bad8-633a0b57c901", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/intel.overresearched.net/post/3mk6ueejzrc2q", "content": "", "creation_timestamp": "2026-04-23T20:34:55.244972Z"}, {"uuid": "abad5dd2-2636-4ff1-82e5-2433594eab74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/dnulkjkjh.bsky.social/post/3mk72yxpywn27", "content": "", "creation_timestamp": "2026-04-23T22:33:47.578625Z"}, {"uuid": "666d367e-f455-4553-95dc-3daf231af69c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mk7i6drwho2g", "content": "", "creation_timestamp": "2026-04-24T02:29:28.651465Z"}, {"uuid": "94d4e45c-87cd-445f-baab-d13cc3ee7721", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mk7lzuzcs22d", "content": "", "creation_timestamp": "2026-04-24T03:38:32.692647Z"}, {"uuid": "ae81f6f4-dc06-4ae8-98c1-98ffeca5d983", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mk7remnxas2d", "content": "", "creation_timestamp": "2026-04-24T05:14:02.137596Z"}, {"uuid": "c3bdd52f-e881-456b-b21e-c19ed42a6deb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28525", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116458047820723949", "content": "", "creation_timestamp": "2026-04-24T05:33:06.768456Z"}, {"uuid": "e24386b9-d1d1-4c5f-b84b-9b3b04477304", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28825", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mk7te2p6fc2w", "content": "", "creation_timestamp": "2026-04-24T05:49:33.751018Z"}, {"uuid": "cec87976-37af-4268-b2ca-0a311f8c629c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mk7w45dxvc2d", "content": "", "creation_timestamp": "2026-04-24T06:38:45.755142Z"}, {"uuid": "acf148e0-5b54-4217-9ceb-2062d2b66f73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116460945533775058", "content": "", "creation_timestamp": "2026-04-24T17:50:02.798744Z"}, {"uuid": "cc07f893-e682-405e-8dd2-54b407c2daa4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mkb3mx4okl2a", "content": "", "creation_timestamp": "2026-04-24T17:50:18.388836Z"}, {"uuid": "03ea59b9-a9ea-498a-9a9c-afd651ac0414", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/dnulkjkjh.bsky.social/post/3mkb3wxokhz2j", "content": "", "creation_timestamp": "2026-04-24T17:55:53.838697Z"}, {"uuid": "b9e5a9ee-3609-46eb-9cc8-9b22aaed74df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28858", "type": "seen", "source": "https://t.me/GithubRedTeam/79125", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-28858\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kaleth4\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-06 17:57:10\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-06T18:00:04.000000Z"}, {"uuid": "a4696617-2342-471e-9fe3-74219452f2f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28704", "type": "seen", "source": "Telegram/MRfn40d2BNWL_uj4zjxAKfWjhqe_ew5yyWaHuqnEy-nXqe4", "content": "", "creation_timestamp": "2026-04-10T09:17:31.000000Z"}, {"uuid": "77f38bdd-a019-427f-a205-1f53b27fe9dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28767", "type": "published-proof-of-concept", "source": "Telegram/gRG1YNPgKTOZJrmhE4GIDK8JXBCMivinEoGiTEUHs5vhIFA", "content": "", "creation_timestamp": "2026-04-02T19:00:12.000000Z"}, {"uuid": "5fba9388-3554-4c60-b68d-16861122380b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28703", "type": "seen", "source": "Telegram/YV8cS3UbatxDTGe0fjayhbeNknefcE-s36BQ9lt853A06hI", "content": "", "creation_timestamp": "2026-04-03T13:19:05.000000Z"}, {"uuid": "abba21c2-e428-40fb-a509-36597631455e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28286", "type": "published-proof-of-concept", "source": "Telegram/FSLrga5GWrvpmeBVVaiQjjslIGqlG9dAkDvrcZ703Y3a2_k", "content": "", "creation_timestamp": "2026-04-06T03:00:06.000000Z"}, {"uuid": "c5c61292-ba88-45e4-afc8-c9ced0c5c320", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28291", "type": "published-proof-of-concept", "source": "Telegram/61DYlWTca6IkcT_FpN2RYBtwr9MKXFEKysLP63-1xRoUERI", "content": "", "creation_timestamp": "2026-04-13T19:19:04.000000Z"}, {"uuid": "86964f2b-4477-48d1-9115-d7dd9384bc37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28389", "type": "published-proof-of-concept", "source": "Telegram/ocY7CMAVdl5z1ZrwE09X4G8ejMp6QG7lQS1Urj-FVASXJRk", "content": "", "creation_timestamp": "2026-04-10T23:26:39.000000Z"}, {"uuid": "93d24bbb-a66f-480d-b0d4-b6e8d85d73bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28386", "type": "published-proof-of-concept", "source": "Telegram/ocY7CMAVdl5z1ZrwE09X4G8ejMp6QG7lQS1Urj-FVASXJRk", "content": "", "creation_timestamp": "2026-04-10T23:26:39.000000Z"}, {"uuid": "a84950b5-f8e5-4020-be7a-7709490a2031", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28205", "type": "seen", "source": "Telegram/6RgwCZFc4Ae1eVERGO141ZaFCzd_AoL4kSRzFJKo9cZLKyo", "content": "", "creation_timestamp": "2026-04-09T21:22:00.000000Z"}, {"uuid": "ed57cb79-10b7-44e6-9209-afd5bfef2029", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28388", "type": "published-proof-of-concept", "source": "Telegram/ocY7CMAVdl5z1ZrwE09X4G8ejMp6QG7lQS1Urj-FVASXJRk", "content": "", "creation_timestamp": "2026-04-10T23:26:39.000000Z"}, {"uuid": "f7392ff7-6386-488b-b189-b0992ae31a00", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28390", "type": "published-proof-of-concept", "source": "Telegram/ocY7CMAVdl5z1ZrwE09X4G8ejMp6QG7lQS1Urj-FVASXJRk", "content": "", "creation_timestamp": "2026-04-10T23:26:39.000000Z"}, {"uuid": "0792104d-7c84-426e-9579-3f199519d6df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28766", "type": "published-proof-of-concept", "source": "Telegram/Y6tkTwR3TbgbL_qd0XdHY3LGxaSf8SFw0ekLA3xjK-BPXbc", "content": "", "creation_timestamp": "2026-04-03T23:21:03.000000Z"}, {"uuid": "2056198a-f9c0-421c-983c-fbc30e458d43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28767", "type": "published-proof-of-concept", "source": "Telegram/xPemCocsCKUXmxN-FoOBBJ3iutE4pbP0FjqrQP2HmxHDku0", "content": "", "creation_timestamp": "2026-04-02T21:00:04.000000Z"}, {"uuid": "2707e6b0-46d6-4664-8616-004f2292ba6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28767", "type": "published-proof-of-concept", "source": "Telegram/O4LcqucU1LaZaaWyFLISymaCFCoMKyIZUhNwooAElOjim-8", "content": "", "creation_timestamp": "2026-04-07T09:00:04.000000Z"}, {"uuid": "89a1ca8e-af6b-47e9-a357-7e5f97755a97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28808", "type": "published-proof-of-concept", "source": "Telegram/QBh1F_HyWJUCKYAyST3Bw6jIrLbUd_JEHanO8DcWQ_ylla0", "content": "", "creation_timestamp": "2026-04-07T15:21:06.000000Z"}, {"uuid": "53a061f6-cbbc-4fcc-98f1-a5a876b9b130", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28788", "type": "seen", "source": "Telegram/67MCm8uvWkL1PFFVLqu-Ae9nhYuAfQmsKMFjCSOu4hiA4mc", "content": "", "creation_timestamp": "2026-03-27T01:18:53.000000Z"}, {"uuid": "18ed3e07-920b-4e17-9635-d62ff9660b7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28805", "type": "published-proof-of-concept", "source": "Telegram/613aY007LGHyW6_rIrja4BsrlzuBvUbPzSCrjge10VR5WoE", "content": "", "creation_timestamp": "2026-04-02T15:21:07.000000Z"}, {"uuid": "ff3bcbe8-f3fe-403d-a319-404807c5fe44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28766", "type": "published-proof-of-concept", "source": "Telegram/O4LcqucU1LaZaaWyFLISymaCFCoMKyIZUhNwooAElOjim-8", "content": "", "creation_timestamp": "2026-04-07T09:00:04.000000Z"}, {"uuid": "b354ce67-ca60-4d32-a6fb-709db9553136", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28767", "type": "seen", "source": "https://t.me/GithubRedTeam/78481", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a ICSA-26-055-03\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a MichaelAdamGroberman\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-02 15:58:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCISA Advisory ICSA-26-055-03 (Update A) \u2014 Gardyn Home Kit IoT Vulnerabilities \u2014 10 CVEs (CVE-2025-1242, CVE-2025-10681, CVE-2025-29628, CVE-2025-29629, CVE-2025-29631, CVE-2026-28766, CVE-2026-25197, CVE-2026-32646, CVE-2026-28767, CVE-2026-32662)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-02T16:00:04.000000Z"}, {"uuid": "c1e12109-cc19-432f-b529-bfc3ea279e81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28766", "type": "seen", "source": "https://t.me/GithubRedTeam/78512", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-28766\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a MichaelAdamGroberman\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-02 23:17:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-28766: Missing Authentication on User Account Endpoint \u2014 Gardyn Home Kit (ICSA-26-055-03)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-03T00:00:03.000000Z"}, {"uuid": "9b6d0cb3-9908-4da6-9f91-75e55b723727", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28767", "type": "seen", "source": "https://t.me/GithubRedTeam/78535", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-28767\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a MichaelAdamGroberman\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-03 01:58:42\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-28767: Missing Authentication on Admin Notifications Endpoint \u2014 Gardyn Home Kit (ICSA-26-055-03)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-03T02:00:03.000000Z"}, {"uuid": "10ac5ef8-ee92-40bb-a3dc-560c001e1b84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28261", "type": "seen", "source": "Telegram/FBQIm_tKRYvjgrE67wEx022AiT_PIajHaRZbB9YF5GqyRME", "content": "", "creation_timestamp": "2026-04-08T15:16:22.000000Z"}, {"uuid": "92e0d9ab-e488-414b-bf24-4fef9e199a03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28377", "type": "seen", "source": "Telegram/8zEAgaRSdVOPVh8YiiaVjapuYDuCzrad_OizJ-8M58UocKc", "content": "", "creation_timestamp": "2026-03-26T23:20:03.000000Z"}, {"uuid": "e9defbf6-4e0e-43cc-a610-b13b53209fe2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28466", "type": "published-proof-of-concept", "source": "Telegram/6KoHZjMq_SrRer1qOlNvHvxjVQOdHuGlAhA7BVnle1PXd2U", "content": "", "creation_timestamp": "2026-03-28T21:00:05.000000Z"}, {"uuid": "41c37f4e-36bd-4226-97d4-53e05b3c29c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28228", "type": "seen", "source": "Telegram/qLRVxcBpXT_mPFtTmfhugZI-eibNxK7vt9WwygicfOox0-Q", "content": "", "creation_timestamp": "2026-03-30T23:20:18.000000Z"}, {"uuid": "56d21894-5ebe-4b2c-8ed7-bc50f9586428", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28367", "type": "seen", "source": "Telegram/aqievDs9oCICHmk4C8wabuGpxUWUtlG5g0Gk9aIz6TfeTOo", "content": "", "creation_timestamp": "2026-03-27T19:18:53.000000Z"}, {"uuid": "16805666-b586-43e7-9934-47bd6ce85939", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28369", "type": "published-proof-of-concept", "source": "Telegram/XCH0TsqFcgtqQSEM226PLv68rO7cMcwSSZTFwAARVhm43GQ", "content": "", "creation_timestamp": "2026-03-27T19:19:15.000000Z"}, {"uuid": "22259a55-eaff-4e10-b601-28b3a3bdd3e1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28368", "type": "published-proof-of-concept", "source": "Telegram/XCH0TsqFcgtqQSEM226PLv68rO7cMcwSSZTFwAARVhm43GQ", "content": "", "creation_timestamp": "2026-03-27T19:19:15.000000Z"}, {"uuid": "3e5eebfc-d6da-47d1-bec2-490745395a98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28505", "type": "published-proof-of-concept", "source": "Telegram/BUI_3SEyOfGtUgM1Z1U1o2mGpepftA8GfZph5NShzoYe3c8", "content": "", "creation_timestamp": "2026-03-30T21:21:54.000000Z"}, {"uuid": "5f02b7ea-027e-4d15-b107-ca3bb035b3bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28256", "type": "seen", "source": "Telegram/svRbUAS3r6GAYzDJQh3Todl-Lk2he1i8bWM_Ex2GJpo_g2k", "content": "", "creation_timestamp": "2026-03-27T15:17:14.000000Z"}, {"uuid": "08ade16c-f7ea-423f-bf05-9fa56738a06d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28254", "type": "published-proof-of-concept", "source": "Telegram/g4UVY8i00Fvp2poaqkkwyG2Aov1eL0WpFh7BWtAhzFw0vL8", "content": "", "creation_timestamp": "2026-03-27T17:22:00.000000Z"}, {"uuid": "9820d8a0-6898-4671-99e7-c28981642b15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28368", "type": "seen", "source": "Telegram/aqievDs9oCICHmk4C8wabuGpxUWUtlG5g0Gk9aIz6TfeTOo", "content": "", "creation_timestamp": "2026-03-27T19:18:53.000000Z"}, {"uuid": "f7fd248b-8211-4bdb-b224-c34a1268a90b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28766", "type": "published-proof-of-concept", "source": "Telegram/xPemCocsCKUXmxN-FoOBBJ3iutE4pbP0FjqrQP2HmxHDku0", "content": "", "creation_timestamp": "2026-04-02T21:00:04.000000Z"}, {"uuid": "5a756b01-f510-499f-a015-2d6ea5b0d15a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28363", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/78854", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-28363\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a kaleth4\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-05 01:45:23\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-05T02:00:04.000000Z"}, {"uuid": "a9ee1d2b-90d2-45a2-acdd-a70fe8603181", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28754", "type": "seen", "source": "Telegram/YV8cS3UbatxDTGe0fjayhbeNknefcE-s36BQ9lt853A06hI", "content": "", "creation_timestamp": "2026-04-03T13:19:05.000000Z"}, {"uuid": "b6d6bdd8-a95f-4064-8a46-aa619d902bec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28756", "type": "seen", "source": "Telegram/YV8cS3UbatxDTGe0fjayhbeNknefcE-s36BQ9lt853A06hI", "content": "", "creation_timestamp": "2026-04-03T13:19:05.000000Z"}, {"uuid": "889c0a42-1efb-4a02-a677-122526e18b4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28766", "type": "seen", "source": "https://t.me/GithubRedTeam/78481", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a ICSA-26-055-03\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a MichaelAdamGroberman\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-04-02 15:58:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCISA Advisory ICSA-26-055-03 (Update A) \u2014 Gardyn Home Kit IoT Vulnerabilities \u2014 10 CVEs (CVE-2025-1242, CVE-2025-10681, CVE-2025-29628, CVE-2025-29629, CVE-2025-29631, CVE-2026-28766, CVE-2026-25197, CVE-2026-32646, CVE-2026-28767, CVE-2026-32662)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-04-02T16:00:04.000000Z"}, {"uuid": "b41b7f25-b322-499d-b767-69d7650179e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28815", "type": "seen", "source": "Telegram/DMrtbPbyVuvJyzUNlrr2TA99ljgvsTw1ZTHgoXyjyFD12Ec", "content": "", "creation_timestamp": "2026-04-03T15:23:03.000000Z"}, {"uuid": "e6f700ec-3091-434d-bf1e-ff8db26633b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28797", "type": "published-proof-of-concept", "source": "Telegram/CEl2HN4MrzqJMXyxgw87__k5eg4RsD4Gdp10Ib2z_QOK7Dk", "content": "", "creation_timestamp": "2026-04-03T23:21:37.000000Z"}, {"uuid": "3560cd3d-074e-45f3-9e4b-5d6a57de3a58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28798", "type": "published-proof-of-concept", "source": "Telegram/qTocgF1bA6EikMAxrpKqC2AQPtdVVaE6KT_y64KQmK5LJ1E", "content": "", "creation_timestamp": "2026-04-03T21:17:42.000000Z"}, {"uuid": "4df5fbcb-71ca-4363-bbea-fcf9fc3f3db9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28466", "type": "seen", "source": "https://t.me/GithubRedTeam/77656", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-28466\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Orioning\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a None\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-03-28 12:59:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-03-28T13:00:04.000000Z"}, {"uuid": "ae7d1c1e-725a-4dcb-bdbf-c25ef4969b46", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2857", "type": "published-proof-of-concept", "source": "https://t.me/realcodeb0ss/331", "content": "https://nvd.nist.gov/vuln/detail/CVE-2026-2857\n\nFofa : title=\"DWR-M960\"", "creation_timestamp": "2026-02-21T12:27:52.000000Z"}, {"uuid": "96433638-e30f-46a1-bbb2-88c2726f5113", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2870", "type": "published-proof-of-concept", "source": "https://t.me/realcodeb0ss/333", "content": "https://nvd.nist.gov/vuln/detail/CVE-2026-2870\n\n\nheader=\"Tenda\"", "creation_timestamp": "2026-02-21T17:38:28.000000Z"}, {"uuid": "04c307d6-58a8-4344-ab50-ca3d3ccfebf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28414", "type": "published-proof-of-concept", "source": "https://t.me/realcodeb0ss/348", "content": "https://nvd.nist.gov/vuln/detail/CVE-2026-28414\n\napp=\"Gradio\"", "creation_timestamp": "2026-02-28T00:28:18.000000Z"}, {"uuid": "d5a462bd-27b2-4fd2-bdf7-e84269de9524", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://t.me/true_secator/7962", "content": "Ox Security \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442 \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u0440\u0435\u0448\u0435\u043d\u0438\u0438 FreeScout, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u043c \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0439 \u043a\u043e\u0434 \u0434\u043b\u044f \u0441\u043b\u0443\u0436\u0431 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0438 \u043e\u0431\u0449\u0438\u0445 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u044f\u0449\u0438\u043a\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0430\u0442\u0430\u043a \u0441 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c \u043a\u043e\u0434\u0430 (RCE) \u0431\u0435\u0437 \u043a\u043b\u0438\u043a\u0430.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-28289 (CVSS 10/10) \u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043e\u0431\u0445\u043e\u0434\u043d\u043e\u0439 \u043f\u0443\u0442\u044c \u0434\u043b\u044f CVE-2026-27636, \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0441 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0435\u0439.\n\n\u041f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u0430\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u043e\u043f\u0438\u0441\u0430\u043d\u043d\u0430\u044f \u043a\u0430\u043a \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u0444\u0430\u0439\u043b\u0430 .htaccess \u0432 \u0441\u043f\u0438\u0441\u043a\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439 \u043d\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0444\u0430\u0439\u043b\u043e\u0432, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u0444\u0430\u0439\u043b .htaccess, \u0432\u043c\u0435\u0448\u0430\u0442\u044c\u0441\u044f \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u0444\u0430\u0439\u043b\u0430 \u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c RCE.\n\n\u041f\u0430\u0442\u0447 \u0434\u043b\u044f \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE,\u00a0\u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u043e\u0439 Ox Security, \u043c\u043e\u0436\u043d\u043e \u043e\u0431\u043e\u0439\u0442\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u0441\u0438\u043c\u0432\u043e\u043b \u043f\u0440\u043e\u0431\u0435\u043b\u0430 \u043d\u0443\u043b\u0435\u0432\u043e\u0439 \u0448\u0438\u0440\u0438\u043d\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435\u0432\u0438\u0434\u0438\u043c \u0438 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043d\u0430 \u0442\u043e\u0447\u043a\u0443, \u0432 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0447\u0435\u0433\u043e \u043d\u0430 \u0434\u0438\u0441\u043a \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0435 \u0438\u043c\u044f \u0444\u0430\u0439\u043b\u0430 .htaccess.\n\n\u041f\u043e \u043c\u043d\u0435\u043d\u0438\u044e \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432 FreeScout, CVE-2026-28289 - \u044d\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u043e\u0439 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f (TOCTOU) \u0432 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u043e\u0447\u0438\u0441\u0442\u043a\u0438 \u0438\u043c\u0435\u043d \u0444\u0430\u0439\u043b\u043e\u0432, \u00ab\u0433\u0434\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u0440\u0435\u0444\u0438\u043a\u0441\u0430 \u0442\u043e\u0447\u043a\u0438 \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442 \u0434\u043e \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043e\u0447\u0438\u0441\u0442\u043a\u0438 \u0443\u0434\u0430\u043b\u044f\u044e\u0442\u0441\u044f \u043d\u0435\u0432\u0438\u0434\u0438\u043c\u044b\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u044b\u00bb.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 CVE-2026-27636 \u0431\u044b\u043b\u043e \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u043d\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443 \u0438\u043c\u0435\u043d \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044f\u043c\u0438 \u0438\u043b\u0438 \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0438\u0435\u0441\u044f \u0441 \u0442\u043e\u0447\u043a\u0438 (\u00ab.\u00bb) \u043f\u0443\u0442\u0435\u043c \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0438\u0432\u0430\u043d\u0438\u044f \u043a \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u0438\u044e \u0444\u0430\u0439\u043b\u0430.\n\n\u0414\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u0442 \u043a \u0438\u043c\u0435\u043d\u0438 \u0444\u0430\u0439\u043b\u0430 \u0441\u0438\u043c\u0432\u043e\u043b \u043d\u0443\u043b\u0435\u0432\u043e\u0439 \u0448\u0438\u0440\u0438\u043d\u044b (Unicode U+200B). \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u044d\u0442\u043e\u0442 \u0441\u0438\u043c\u0432\u043e\u043b \u043d\u0435 \u0440\u0430\u0441\u0441\u043c\u0430\u0442\u0440\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u0432\u0438\u0434\u0438\u043c\u043e\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435, \u043e\u043d\u043e \u043e\u0431\u0445\u043e\u0434\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443, \u0441\u0438\u043c\u0432\u043e\u043b U+200B \u0443\u0434\u0430\u043b\u044f\u0435\u0442\u0441\u044f, \u0438 \u0444\u0430\u0439\u043b \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043d\u0430\u0441\u0442\u043e\u044f\u0449\u0438\u0439 \u0442\u043e\u0447\u0435\u0447\u043d\u044b\u0439 \u0444\u0430\u0439\u043b.\n\n\u0410\u0442\u0430\u043a\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u0443\u0442\u0435\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0433\u043e \u043f\u0438\u0441\u044c\u043c\u0430 \u0441 \u043b\u044e\u0431\u043e\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u0430 \u043d\u0430 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0439 \u044f\u0449\u0438\u043a, \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0439 \u0432 FreeScout.\n\n\u0412\u0430\u0436\u043d\u043e \u043e\u0442\u043c\u0435\u0442\u0438\u0442\u044c, \u0447\u0442\u043e \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u041f\u041e \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043d\u0430 \u0434\u0438\u0441\u043a \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 FreeScout, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434.\n\n\u041a\u0430\u043a \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442 Ox Security, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0435\u0434\u0441\u043a\u0430\u0437\u0430\u0442\u044c, \u0433\u0434\u0435 \u0444\u0430\u0439\u043b \u0431\u0443\u0434\u0435\u0442 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d \u043d\u0430 \u0434\u0438\u0441\u043a\u0435, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0435\u043c\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u043c\u0443 \u043a\u043e\u0434\u0443 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n\n\u0423\u0441\u043f\u0435\u0448\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043d\u043e\u0432\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438, \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0437\u0430\u044f\u0432\u043a\u0438 \u0432 \u0441\u0430\u043f\u043e\u0440\u0442, \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u044f\u0449\u0438\u043a\u043e\u0432 \u0438 \u0434\u0440\u0443\u0433\u0438\u0435 \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0438\u0437 FreeScout, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043f\u0435\u0440\u0435\u0439\u0442\u0438 \u043d\u0430 \u0434\u0440\u0443\u0433\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432 \u0441\u0435\u0442\u0438.\n\n\u0412\u0441\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 FreeScout 1.8.206 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u0438 \u0440\u0430\u0431\u043e\u0442\u0435 \u043d\u0430 Apache \u0441 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0439 \u043e\u043f\u0446\u0438\u0435\u0439 AllowOverride All (\u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u0430\u044f \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044f). CVE-2026-28289 \u0431\u044b\u043b\u0430\u00a0\u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 FreeScout 1.8.207.\n\n\u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f.", "creation_timestamp": "2026-03-04T13:42:17.000000Z"}, {"uuid": "653d849b-6365-462a-b068-bfcaa704bc62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28774", "type": "seen", "source": "https://t.me/cKure/16019", "content": "\u25a0\u25a0\u25a0\u25a0\u25a1 CVE-2026-28774\nAn OS Command Injection vulnerability exists in the web-based Traceroute diagnostic utility of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101. An authenticated attacker can inject arbitrary shell metacharacters (such as the pipe | operator) into the flags parameter, leading to the execution of arbitrary operating system commands with root privileges.", "creation_timestamp": "2026-03-04T09:13:02.000000Z"}, {"uuid": "ac8023de-75c1-4be0-83dc-35c6794bb5d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/mloadenthal.bsky.social/post/3mke5h2lazs22", "content": "", "creation_timestamp": "2026-04-25T23:00:46.943407Z"}, {"uuid": "05334288-c113-429d-87c3-0e24ec8f9ab5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://bsky.app/profile/technoholic.bsky.social/post/3mkgpjf57ir2f", "content": "", "creation_timestamp": "2026-04-26T23:29:31.828702Z"}, {"uuid": "f212438c-fd21-4dad-a004-6e6b74baefa3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28224", "type": "seen", "source": "Telegram/o-uTgZiWLI4DGr-3Qx2v6r5S9u58WJIjtqdTFR62kB0PIWs", "content": "", "creation_timestamp": "2026-04-17T21:22:46.000000Z"}, {"uuid": "1e1bc15c-7f18-47aa-825a-b5f2783ee121", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28212", "type": "seen", "source": "Telegram/1afGr9vW06Zk0J3YeUW4MdlUf8TA53EPyuLeVgpLZqfvxp8", "content": "", "creation_timestamp": "2026-04-17T21:22:32.000000Z"}, {"uuid": "ebf6ee77-c73a-4250-a409-9bb383353b2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "Telegram/_4EldcjJ2XVTlnAmM3Yr-KR1sU9fsDmW6Yh7q2sUZXcUvw", "content": "", "creation_timestamp": "2026-04-23T10:15:22.000000Z"}, {"uuid": "5ab9a8ea-08b1-4328-bd6a-353fa7e1ed4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28427", "type": "seen", "source": "Telegram/GomAqAKioRw5ORwyc6ugTkWhk08fHowYPUM-Q49l2oeUgi0", "content": "", "creation_timestamp": "2026-04-21T17:18:10.000000Z"}, {"uuid": "89d6de91-b12f-4b15-b261-99378026838b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2834", "type": "seen", "source": "Telegram/xHZW3dnIVlZ81UM5ayk21xAksqc_QlW_sb2BCoesl5IB3eE", "content": "", "creation_timestamp": "2026-04-22T21:20:26.000000Z"}, {"uuid": "ce6a9254-49bc-4b5a-8822-d8a1dca95b2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2810", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mknpx26o5f2e", "content": "CVE-2026-2810 - Endpoint DLP Driver Out-of-Bounds Read\nCVE ID : CVE-2026-2810\n \n Published : April 29, 2026, 3:23 p.m. | 54\u00a0minutes ago\n \n Description : Netskope was notified about a potential gap in the Endpoint DLP Module for Netskope Client on Windows systems. The successfu...", "creation_timestamp": "2026-04-29T18:25:47.941705Z"}, {"uuid": "25f28741-5000-459a-bd57-4e32bca6c62c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28813", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/dmiispwlcnpj3", "content": "CVE-2026-28813: Apache JSPWiki: JSON hijacking", "creation_timestamp": "2026-07-30T14:25:09.929952Z"}, {"uuid": "2c5d998d-f794-47ee-a7fd-dc476f5db6be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28814", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/bikbl5vic3fxe", "content": "CVE-2026-28814: Apache JSPWiki: Arbitrary Wiki Markup rendering due to lack of authentication", "creation_timestamp": "2026-07-30T14:31:10.022255Z"}, {"uuid": "d284d886-dc08-46bd-9446-dc4c7873a250", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28983", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:01:07.519163Z"}, {"uuid": "3ae0c2a9-dc57-44c4-a3bc-5526a4294cd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28900", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:01:07.635314Z"}, {"uuid": "b69bbebe-1345-40b4-ba6f-db38191de63e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28912", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:01:11.760444Z"}, {"uuid": "bdc0120a-1dbe-45a9-9047-3c06c07f7b11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28896", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:01:11.991152Z"}, {"uuid": "4de5adad-3284-4bcb-888d-69d3d5ff7858", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28928", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:00:53.674043Z"}, {"uuid": "c2b0ec20-628e-4f50-b162-89e7b560d2f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28849", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:00:55.068852Z"}, {"uuid": "6885702a-fb04-4d17-980a-48f1f3044c40", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28936", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:00:57.310509Z"}, {"uuid": "90628523-dba2-4bb7-804f-ac323fa0f03b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28981", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:01:00.368413Z"}, {"uuid": "ce73588b-3816-46d3-b9ed-d2d037e11516", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28931", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:01:03.433688Z"}, {"uuid": "5dd8a10c-3b1d-4c90-a282-1f9c51fa2219", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28982", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:01:03.557574Z"}, {"uuid": "8755bb97-17e7-49f7-be6d-1fb0488e197f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28926", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:00:58.589953Z"}, {"uuid": "187cf896-b9c5-4e3f-96ff-066a8227945c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28945", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:00:58.698834Z"}, {"uuid": "3cac125f-5fb2-42f2-bf1e-ca9288b1c0da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28973", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:01:07.885423Z"}, {"uuid": "722570ef-51ff-455d-90a5-17fb8324a4c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28911", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:01:09.324499Z"}, {"uuid": "050b04c0-9d8a-467d-9832-09fdbfae3a56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28961", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:01:11.469275Z"}, {"uuid": "2df59026-009f-45b7-afb9-6244630293f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28914", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:01:22.367631Z"}, {"uuid": "697f6b9e-d6fc-4936-9222-70559f7dddaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28979", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:01:21.327654Z"}, {"uuid": "f4bc836b-e272-4796-bd3d-aff1db619b2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28932", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-30T16:01:22.212450Z"}, {"uuid": "97de6d7d-6547-4cfb-8aec-91b840195a73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28323", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mruvtcjthk2z", "content": "CVE-2026-28323 - web help desk\nIf enabled, a vulnerability in SolarWinds Web Help Desk could allow unauthorized access to the system. This means that someone might be able to access the system without needing a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#solarwinds #CVE #infosec", "creation_timestamp": "2026-07-30T16:56:04.516434Z"}, {"uuid": "54669104-c5f8-42f2-9a1b-9082191d0660", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28912", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:00:54.430661Z"}, {"uuid": "a097f894-4c7d-4e1d-87af-0efe3193e172", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28932", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:01:06.510219Z"}, {"uuid": "b8f55bea-7870-49b9-89cb-7d0df36ebf45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28936", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:00:40.060383Z"}, {"uuid": "321ac9f6-3fde-4071-8754-8ba80132692e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28928", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:00:36.543313Z"}, {"uuid": "f7a1dd1b-b25b-4b4e-bdf1-e7b275e999df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28926", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:00:41.494748Z"}, {"uuid": "46a20ec4-b77d-4a80-a91f-cea29ae80dc7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28981", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:00:43.452785Z"}, {"uuid": "c34d375c-0a2a-4a94-86c2-7c754097b7b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28945", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:00:41.652676Z"}, {"uuid": "13632dc9-ebc8-488a-873b-1a4bc1908056", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28896", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:00:54.733791Z"}, {"uuid": "7678b46c-b53f-4b81-9f5d-f1a25236739c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28849", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:00:37.942705Z"}, {"uuid": "c7f6fa88-f211-4ed1-926c-dddcce4dc294", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28961", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:00:54.135397Z"}, {"uuid": "0b6a91fe-2bce-4f98-8c1c-1f90891ba186", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28931", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:00:45.853735Z"}, {"uuid": "c4c91b2d-d89d-41cf-acf6-c893e6ed2f98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28982", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:00:46.005650Z"}, {"uuid": "4f898a8c-fc0b-45f2-b787-2a8e20ebda99", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28983", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:00:50.220714Z"}, {"uuid": "b93c0579-4934-42b1-9089-bbdc3cbdbbe6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28973", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:00:50.668525Z"}, {"uuid": "4b20ebd3-3f49-4346-a7de-d1b2ca867d2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28911", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:00:52.197948Z"}, {"uuid": "59ce0b8b-8f42-408e-839a-665fe985e712", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28900", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:00:50.373224Z"}, {"uuid": "30780226-dd45-470b-8747-f3deea6e045c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28914", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:01:06.733295Z"}, {"uuid": "1c19f902-b20c-4e11-bfb3-03b516b2934e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28979", "type": "seen", "source": "https://www.thezdi.com/blog/2026/7/29/the-july-2026-apple-security-update-review", "content": "Welcome to our monthly look at Apple security patches. This release shows that Apple is not immune to the bug apocalypse that is impacting other vendors. Last month, they released 37 unique CVEs compare to this month\u2019s 210. Quite a jump.\nFor July 2026, Apple released 210 unique CVEs across iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, and Safari 26.6. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n\u00b7      CVE-2026-43818 (ImageIO) \u2013 This bug could allow the \u201cProcessing [of] a maliciously crafted image may lead to arbitrary code execution.\" ImageIO is the classic zero-/one-click remote surface on Apple platforms (images auto-parsed in Messages, previews, notifications), so this is the highest real-world remote-exploitation risk in the release. It\u2019s also present across iOS and all macOS versions. Depending on delivery path, this is the one most likely to be weaponized into a remote foothold.\n\u00b7      CVE-2026-64747 (AVEVideoEncoder) \u2013 According to Apple, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d Kernel-level code execution is the maximum-impact outcome on an Apple device: full compromise, defeats the sandbox and most mitigations. It's also unusually broad, shipping to iOS/iPadOS, all three macOS versions, tvOS, watchOS, and visionOS. Local-app precondition is its only limiter, and it's exactly the second stage a remote bug chains into.\n\u00b7      CVE-2026-64767 (afpfs) \u2013 In this case, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d This bug is a network-reachable, apparently unauthenticated path to kernel memory corruption via Apple Filing Protocol. Remote plus kernel is a dangerous combination.  Also, the \u201cremote attacker\u201d versus \u201cremote user\u201d wording suggests no authentication required. This bug affects macOS only, which is the only reason it sits at #3 rather than higher.\nHonorable mentions: CVE-2026-43776 (AppleDouble) and the SceneKit set (CVE-2026-64763/64/65/66) are additional file-parsing paths to arbitrary code execution. CVE-2026-43750 (Wi\u2011Fi) allows code execution out of the sandbox with elevated privileges. And finally, CVE-2026-64696 (SMB) / CVE-2026-43810 (Kernel) are further remote kernel-corruption bugs.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Updates \u2014 July 27, 2026\n\n\n\n  \n    \n      210Total CVEs\n      9Code Execution\n      26Elevation of Privilege\n      11Sandbox Escape\n      9Security Feature Bypass\n      15Memory Corruption\n      55Information Disclosure\n      2Spoofing / UI\n      75Denial of Service\n      8Other\n    \n    \n\n      Apple security release — July 27, 2026 (iOS/iPadOS 26.6, macOS Tahoe 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, tvOS 26.6, watchOS 26.6, visionOS 26.6, Safari 26.6). \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS / iPadOS 26.6\n          macOS Tahoe 26.6\n          macOS Sequoia 15.7.8\n          macOS Sonoma 14.8.8\n          tvOS 26.6\n          watchOS 26.6\n          visionOS 26.6\n          Safari 26.6\n        \n      \n      \n      \n        CVE-2026-64732\n        Accessibility\n        An attacker with physical access may be able to access sensitive user data during iPhone Mirroring\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43749\n        Accounts\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43819\n        Accounts\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64733\n        Accounts Framework\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64767\n        afpfs\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-23918\n        apache\n        A remote attacker may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64695\n        APFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43801\n        App Store\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43781\n        Apple Account\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64737\n        Apple Account\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28928\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43748\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43776\n        AppleDouble\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43681\n        AppleRAID\n        A local user may be able to read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43672\n        Assets\n        A malicious application may be able to bypass Privacy preferences\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64702\n        Audio\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64725\n        Audio\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43730\n        AuthKit\n        An app may be able to fingerprint the user\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64747\n        AVEVideoEncoder\n        An app may be able to execute arbitrary code with kernel privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64762\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64707\n        BackgroundAssets\n        An app may be able to delete files for which it does not have permission\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28849\n        BOM\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43811\n        Books\n        An app may be able to modify protected parts of the file system\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64698\n        cd9660\n        An app may be able to cause unexpected system termination or read kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43813\n        CloudAttestation\n        A maliciously crafted app may be able to bypass code signing enforcement\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43797\n        Contacts\n        An app may be able to access information about a user's contacts\n        YesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64734\n        Contacts\n        Processing a maliciously crafted contact may leak sensitive data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64746\n        Contacts\n        An app may be able to add contacts without user authorization\n        YesYesNoNoNoYesYesNo\n      \n      \n        CVE-2026-43756\n        Control Center\n        An app may be able to access user-sensitive data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43693\n        Core Services\n        An app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43673\n        CoreAudio\n        Processing a maliciously crafted audio file may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43744\n        CoreAudio\n        Processing an audio stream in a maliciously crafted media file may terminate the process\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43803\n        CoreAudio\n        A remote attacker may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43711\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43759\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesNoNoNoYesNoNo\n      \n      \n        CVE-2026-43775\n        CoreMedia\n        An app may be able to access sensitive user data\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28936\n        CoreServices\n        Processing a maliciously crafted file may lead to unexpected app termination\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43802\n        CoreVideo\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64710\n        Crash Reporter\n        An app may be able to leak sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39875\n        CUPS\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-3783\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-3784\n        curl\n        Authentication credentials may be sent to a server on another origin\n        YesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43758\n        Data Detectors UI\n        An app may be able to access sensitive user data\n        NoYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64708\n        DesktopServices\n        An app may bypass Gatekeeper checks\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28926\n        Disk Images\n        An app may be able to elevate privileges\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28945\n        Disk Images\n        An app may be able to bypass network restrictions\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43747\n        Disk Images\n        Parsing a maliciously crafted file may lead to an unexpected app termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64694\n        Disk Images\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64776\n        Disk Images\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43753\n        DriverKit\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43793\n        DriverKit\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43714\n        Foundation\n        A malicious app may be able to access protected user data\n        YesYesYesYesNoYesYesNo\n      \n      \n        CVE-2026-64742\n        FrontBoard\n        An app may be able to access sensitive user data\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43796\n        Game Center\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64740\n        Game Center\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-64691\n        GPU Drivers\n        An app may be able to cause unexpected system termination\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64692\n        Heimdal\n        An app may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28981\n        HFS\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43682\n        HFS\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43710\n        HFS\n        An attacker may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43764\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43767\n        HFS\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43773\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64697\n        HFS\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2025-43325\n        Icons\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43780\n        ImageIO\n        Processing a maliciously crafted texture may lead to unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43818\n        ImageIO\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64693\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64716\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64754\n        ImageIO\n        Processing a maliciously crafted file may lead to a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43805\n        IOKit\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-39877\n        IOSkywalkFamily\n        An app may be able to disclose kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28931\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-28982\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43739\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43754\n        Kernel\n        An app may be able to leak sensitive kernel state\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43757\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43769\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43778\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43782\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43799\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43809\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43810\n        Kernel\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43814\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-43816\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43817\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-43822\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64700\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64709\n        Kernel\n        An app may be able to disclose kernel memory\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64720\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64721\n        Kernel\n        An app may be able to access sensitive user data\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64723\n        Kernel\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64727\n        Kernel\n        An app may be able to cause unexpected system termination\n        NoYesNoNoYesNoNoNo\n      \n      \n        CVE-2026-64729\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64735\n        Kernel\n        A remote attacker may be able to bypass network filters\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64744\n        Kernel\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64749\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        YesYesYesNoNoNoYesNo\n      \n      \n        CVE-2026-64751\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64775\n        Kernel\n        An app may be able to cause unexpected system termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-20672\n        LaunchServices\n        An app may be able to access sensitive user data\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28983\n        LaunchServices\n        A remote attacker may be able to cause a denial of service\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-28900\n        libarchive\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-4424\n        libarchive\n        Processing a maliciously crafted file may result in disclosure of process memory\n        YesYesYesYesNoNoYesNo\n      \n      \n        CVE-2026-28973\n        libc\n        A malicious app may be able to break out of its sandbox\n        YesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-64739\n        Libnotify\n        An attacker may be able to cause unexpected app termination\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43766\n        LoginWindow\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64743\n        Managed Configuration\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64738\n        Maps\n        A malicious app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43653\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        NoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43806\n        mDNSResponder\n        A local attacker may be able to cause a denial of service\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-64724\n        mDNSResponder\n        An attacker on the local network may be able to cause a denial-of-service\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43723\n        MediaRemote\n        An app may be able to gain root privileges\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-28911\n        Metal\n        A malicious app may be able to corrupt memory of a system process\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43807\n        MobileAccessoryUpdater\n        A malicious accessory may be able to cause unexpected app termination\n        NoNoYesYesYesYesYesNo\n      \n      \n        CVE-2026-43729\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43733\n        Model I/O\n        Processing a maliciously crafted image may corrupt process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64722\n        Model I/O\n        Processing a 3D model may result in disclosure of process memory\n        YesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64768\n        Model I/O\n        A remote attacker may cause an unexpected app termination\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64769\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64770\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-64771\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64772\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-64774\n        Model I/O\n        A remote attacker may be able to cause unexpected application termination or heap corruption\n        YesYesYesYesYesNoYesNo\n      \n      \n        CVE-2026-43771\n        Net-SNMP\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43772\n        NetFSFramework\n        An app may be able to break out of its sandbox\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28961\n        Network Extensions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64711\n        NSColorPanel\n        An app may be able to leak sensitive user information\n        YesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28912\n        PackageKit\n        A user may be able to elevate privileges\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43765\n        PackageKit\n        An app may be able to modify protected parts of the file system\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28896\n        ppp\n        An attacker may be able to cause unexpected system termination or read kernel memory\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-64731\n        Printing\n        A malicious app may be able to break out of its sandbox\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43812\n        Pro Res\n        An app may be able to cause unexpected system termination\n        YesYesYesNoYesNoYesNo\n      \n      \n        CVE-2026-43694\n        quarantine\n        An app may be able to cause unexpected system termination or write kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39874\n        Remote Management\n        A malicious app may be able to gain root privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43792\n        Safari\n        An app may be able to access sensitive user data\n        NoYesNoNoNoNoNoYes\n      \n      \n        CVE-2026-64741\n        Sandbox Profiles\n        An app may be able to read a persistent device identifier\n        YesNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64763\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64764\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64765\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-64766\n        SceneKit\n        Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution\n        YesYesYesYesYesYesYesNo\n      \n      \n        CVE-2026-43665\n        Screen Sharing Server\n        A local attacker may be able to determine the legacy VNC password configured for Screen Sharing\n        NoNoYesYesNoNoNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43777\n        Screen Sharing Server\n        A remote attacker may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43779\n        Screen Sharing Server\n        An app may be able to intercept network connections intended for another process\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43728\n        Security\n        An attacker may be able to modify the state of the Keychain\n        NoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43755\n        SecurityAgent\n        An app may be able to gain root privileges\n        NoYesNoYesNoNoNoNo\n      \n      \n        CVE-2026-43800\n        Siri\n        An app may be able to access sensitive user data\n        YesYesNoNoYesYesNoNo\n      \n      \n        CVE-2026-64745\n        Siri\n        A person with physical access to a locked device may be able to access contacts and photos\n        NoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-39873\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64696\n        SMB\n        A remote user may be able to cause unexpected system termination or corrupt kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64704\n        SMB\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43774\n        Spotlight\n        An app may be able to access sensitive user data\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43770\n        StorageKit\n        An app may be able to access sensitive user data\n        NoYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43768\n        udf\n        An app may be able to cause unexpected system termination\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64699\n        WebDAV\n        An app may be able to disclose kernel memory\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64703\n        WebDAV\n        An app may be able to cause a denial-of-service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        YesNoNoNoYesYesYesYes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43804\n        WebKit\n        Visiting a website may lead to an app denial-of-service\n        YesYesNoNoNoNoYesYes\n      \n      \n        CVE-2026-43821\n        WebKit\n        An app may be able to read files outside of its sandbox\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64713\n        WebKit\n        Websites may know if the user has visited a given link\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64728\n        WebKit\n        Maliciously crafted web content may violate iframe sandboxing policy\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64730\n        WebKit\n        Visiting a website that frames malicious content may lead to UI spoofing\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-64757\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-64783\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoNoYesYesYes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        NoNoNoNoYesYesYesNo\n      \n      \n        CVE-2026-64719\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        YesYesNoNoYesYesYesYes\n      \n      \n        CVE-2026-43750\n        Wi-Fi\n        An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64726\n        Wi-Fi\n        An attacker in physical proximity may be able to corrupt process memory\n        YesYesNoNoYesYesYesNo\n      \n      \n        CVE-2026-64755\n        WorkoutKit\n        An app may be able to access sensitive user data\n        YesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28932\n        xar\n        An app may be able to cause a denial of service\n        NoYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-28914\n        zip\n        A maliciously crafted ZIP archive may bypass Gatekeeper checks\n        NoNoYesYesNoNoNoNo\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-31T01:01:05.448272Z"}, {"uuid": "5ab2adce-befe-4fab-994d-3a85d1338711", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28323", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mrvx7w6dy72z", "content": "A SolarWinds Web Help Desk SAML authentication bypass, CVE-2026-28323, scores a critical CVSS 9.8. Update to 2026.2.1 to stay protected.\n\n#SolarWinds #WebHelpDesk #CVE202628323 #SAML #InfoSec", "creation_timestamp": "2026-07-31T02:53:42.278462Z"}, {"uuid": "6b554629-c0dd-456d-a052-d40a37509575", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28496", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/985fe015-dcb1-4491-b111-0e50c961e2ab", "content": "", "creation_timestamp": "2026-08-04T11:00:26.816968Z"}, {"uuid": "8e52de6b-ad39-455c-93d5-4ee4887fd60c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28221", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116491683861953186", "content": "A lot of offensive activities were identified targeting Wazuh (CVE-2026-28221) https://vuldb.com/vuln/360191/cti", "creation_timestamp": "2026-04-30T04:07:12.178819Z"}, {"uuid": "054185f4-7ad5-43d1-a7a6-78ce4d587267", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2892", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mkpvww7iqe2c", "content": "\ud83d\udfe0 CVE-2026-2892 - High (7.5)\n\nThe Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versio...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-2892/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-04-30T15:18:26.777595Z"}, {"uuid": "ec860015-75f9-41dc-9864-2a1ae2f3489c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2892", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mkpzllnuqo2w", "content": "WordPress\u30d7\u30e9\u30b0\u30a4\u30f3\u300cOtter Blocks\u300d\u306e\u5168\u30d0\u30fc\u30b8\u30e7\u30f3\uff083.1.4\u307e\u3067\uff09\u3067\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u653b\u6483\u8005\u304c\u300co_stripe_data\u300d\u30af\u30c3\u30ad\u30fc\u3092\u6539\u3056\u3093\u3057\u3001\u8cfc\u5165\u78ba\u8a8d\u3092\u30d0\u30a4\u30d1\u30b9\u3057\u3066\u30b3\u30f3\u30c6\u30f3\u30c4\u2026\nCVE-2026-2892 CVSS 7.5 | HIGH", "creation_timestamp": "2026-04-30T16:23:40.958983Z"}, {"uuid": "d1ae1ffa-57dc-4a2b-8986-63f44a302b23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2892", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mkq2m23rmz2k", "content": "CVE-2026-2892 - Otter Blocks\nCVE ID : CVE-2026-2892\n \n Published : April 30, 2026, 2:16 p.m. | 2\u00a0hours, 2\u00a0minutes ago\n \n Description : The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4. This is due t...", "creation_timestamp": "2026-04-30T16:41:49.593822Z"}, {"uuid": "c2e4b598-dc82-4f5b-9a6e-e9810d8d9a64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28323", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3muaoaxc25z23", "content": "~Arcticwolf~\nUnauthenticated WHD flaws enable session bypass and DoS; patch to 2026.2.1.\n-\nIOCs: CVE-2026-28323, CVE-2026-28299\n-\n#CVE202628299 #CVE202628323 #ThreatIntel", "creation_timestamp": "2026-08-29T20:02:53.038101Z"}, {"uuid": "728eb6c9-f6a4-48a5-9ea5-648093ae1cbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28299", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3muaoaxc25z23", "content": "~Arcticwolf~\nUnauthenticated WHD flaws enable session bypass and DoS; patch to 2026.2.1.\n-\nIOCs: CVE-2026-28323, CVE-2026-28299\n-\n#CVE202628299 #CVE202628323 #ThreatIntel", "creation_timestamp": "2026-08-29T20:02:53.094720Z"}, {"uuid": "7b0507a9-a762-4722-8fad-4b41ee7b744e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28909", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mkr3pcupys2h", "content": "CVE-2026-28909 - Apache Container Registry Unauthenticated Registry Credentials Exposure\nCVE ID : CVE-2026-28909\n \n Published : April 30, 2026, 11:16 p.m. | 3\u00a0hours, 2\u00a0minutes ago\n \n Description : Users who connect to malicious registries with hostnames matching the bypass pat...", "creation_timestamp": "2026-05-01T02:34:12.912193Z"}, {"uuid": "d24b22df-7039-4bdc-a374-07bb2bc83856", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28780", "type": "seen", "source": "https://bsky.app/profile/slackers.it/post/3ml2v2l43l42x", "content": "8/11\n\nhttps://www.cve.org/CVERecord?id=CVE-2026-28780\n    https://www.cve.org/CVERecord?id=CVE-2026-24072\n    https://www.cve.org/CVERecord?id=CVE-2026-23918\n  (* Security fix *)\nn/krb5-1.22.2-x86_64-2.txz:  Rebuilt.\n  Harden perms on /usr/bin/ksu.", "creation_timestamp": "2026-05-05T00:01:52.722475Z"}, {"uuid": "03e15974-57b4-4894-a219-5a2a06c4b11e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28780", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3ml4fuvyyd22w", "content": "\ud83d\udd17 CVE : CVE-2026-23918, CVE-2026-24072, CVE-2026-28780, CVE-2026-29168, CVE-2026-29169, CVE-2026-33006, CVE-2026-33007, CVE-2026-33523, CVE-2026-33857, CVE-2026-34032, CVE-2026-34059", "creation_timestamp": "2026-05-05T14:35:36.432383Z"}, {"uuid": "c7da40f4-a223-4288-b507-6bad58db46fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28510", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-28510", "content": "", "creation_timestamp": "2026-05-05T04:16:28.000000Z"}, {"uuid": "d0b6f724-dff4-4e36-8075-a71cec18f1f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28780", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3ml4qxtheaj2e", "content": "CVE-2026-28780: Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()", "creation_timestamp": "2026-05-05T17:54:06.488153Z"}, {"uuid": "595387de-ab02-46cf-981b-529749f565c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28780", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ml5k553mji2p", "content": "CVE-2026-28780 - Apache HTTP Server: buffer overflow in mod_proxy_ajp via ajp_msg_check_header()\nCVE ID : CVE-2026-28780\n \n Published : May 5, 2026, 10:16 p.m. | 2\u00a0hours, 6\u00a0minutes ago\n \n Description : Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Se...", "creation_timestamp": "2026-05-06T01:24:26.890339Z"}, {"uuid": "5f1026bd-8591-4e34-a452-78d9afb18041", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28780", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apache-http-server-multiple-vulnerabilities_20260506", "content": "", "creation_timestamp": "2026-05-05T18:00:00.000000Z"}, {"uuid": "e623ead1-9075-4cf9-a66f-67db93ccda18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28799", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3ml6w2wjym52c", "content": "\ud83d\udd17 CVE : CVE-2026-25994, CVE-2026-28799, CVE-2026-32942, CVE-2026-33069", "creation_timestamp": "2026-05-06T14:30:36.591070Z"}, {"uuid": "3af3fd57-55c8-4770-aafe-5f01eabe6915", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28474", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3ml73hkplyz25", "content": "\ud83d\udccc CVE-2026-28474 - OpenClaw's Nextcloud Talk plugin versions prior to 2026.2.6 accept equality matching on the mutable actor.name display name field for allowlist valida... https://www.cyberhub.blog/cves/CVE-2026-28474", "creation_timestamp": "2026-05-06T16:07:09.010905Z"}, {"uuid": "b02d16f5-0456-4eac-b73b-543b6d8b00c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28780", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116528665762835675", "content": "Our CTI team identified a lot of activities targeting Apache HTTP Server (CVE-2026-28780) https://vuldb.com/vuln/361235/cti", "creation_timestamp": "2026-05-06T16:52:11.187268Z"}, {"uuid": "a24b0ed2-301f-4914-acc9-a2ebeaca515c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28780", "type": "seen", "source": "https://ccb.belgium.be/advisories/warning-multiple-vulnerabilities-apache-http-server-can-lead-remote-code-execution-patch", "content": "", "creation_timestamp": "2026-05-06T09:37:53.000000Z"}, {"uuid": "ed9f0ebc-cf84-4761-9637-7d6399cf10f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28780", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml7fc6cvg626", "content": "\ud83d\udd34 CVE-2026-28780 - Critical (9.8)\n\nHeap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.\nIf mod_proxy_ajp...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-28780/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-06T19:03:06.178596Z"}, {"uuid": "b1cc841f-a467-4292-a48a-9d9b01f017f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28780", "type": "seen", "source": "https://t.me/true_secator/8179", "content": "\u041f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u0435\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0442\u044c \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0432\u0430\u0436\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0438\u043c\u0438 \u0443\u0433\u0440\u043e\u0437\u044b, \u043d\u0430 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0441\u0438\u0442\u0443\u0430\u0446\u0438\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0430\u044f:\n\n1. \u0412 Android \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f RCE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, CVE-2026-0073, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 \u041e\u0421 \u0438 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u043e\u0442 \u0438\u043c\u0435\u043d\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u0431\u0435\u0437 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043d\u0430 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u0431\u0435\u0437 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c.\u00a0\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 adbd (Android Debug Bridge daemon), \u0444\u043e\u043d\u043e\u0432\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 Android \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u044e\u0449\u0438\u0439 \u0441\u0432\u044f\u0437\u044c\u044e \u043c\u0435\u0436\u0434\u0443 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e\u043c \u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u043c, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044f \u043e\u0442\u043b\u0430\u0434\u043a\u0443 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0435.\n\n\u041f\u043e\u043a\u0430 \u043a\u0430\u043a\u0438\u0445-\u043b\u0438\u0431\u043e \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-0073 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0432 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0435\u0442, \u043d\u043e \u044d\u0442\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u043a\u0430.\n\n2. Apache \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u0434\u0435\u0441\u044f\u0442\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 HTTP Server \u0438 MINA, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0438 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u043b\u0438 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0434\u043b\u044f RCE.\n\n\u0412 Apache HTTP Server 2.4.67 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0434\u043b\u044f 11 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, 10 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0432\u0441\u0435 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438.\n\n\u041f\u0435\u0440\u0432\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c - CVE-2026-23918, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0443 \u0434\u0432\u043e\u0439\u043d\u043e\u0433\u043e \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u043f\u0430\u043c\u044f\u0442\u0438 \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 HTTP/2. \u0418\u043d\u0438\u0446\u0438\u0438\u0440\u0443\u044f \u043f\u0440\u0435\u0436\u0434\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u0435 \u0441\u0431\u0440\u043e\u0441, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0437\u0432\u0430\u0442\u044c DoS \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434.\n\n\u0414\u0440\u0443\u0433\u0430\u044f, CVE-2026-28780, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043a\u0443\u0447\u0435, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 AJP-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f, \u0432\u044b\u0437\u044b\u0432\u0430\u044f DoS \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044f \u043a\u043e\u0434.\n\n\u0422\u0440\u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, CVE-2026-29168, CVE-2026-29169 \u0438 CVE-2026-33007, \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a DoS, \u0430 \u0435\u0449\u0435 \u0447\u0435\u0442\u044b\u0440\u0435 (CVE-2026-24072, CVE-2026-33857, CVE-2026-34032 \u0438 CVE-2026-34059) - \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438.\n\n\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0442\u0430\u043a\u0436\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u043e\u0439 \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0435\u0439 CRLF (CVE-2026-33523), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c HTTP-\u043e\u0442\u0432\u0435\u0442\u0430\u043c\u0438, \u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0443\u044e \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u043e\u0431\u043e\u0447\u043d\u044b\u0445 \u043a\u0430\u043d\u0430\u043b\u043e\u0432 \u043f\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 (CVE-2026-33006), \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043e\u0431\u0445\u043e\u0434\u0443 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 Digest.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, Apache\u00a0\u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430\u00a0\u043e \u0432\u044b\u043f\u0443\u0441\u043a\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 MINA 2.2.7 \u0438 MINA 2.1.12, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0445 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0434\u0432\u0443\u0445 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 - CVE-2026-42778 \u0438 CVE-2026-42779. \n\n\u041f\u0435\u0440\u0432\u0430\u044f - \u044d\u0442\u043e \u043d\u0435\u043f\u043e\u043b\u043d\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f CVE-2026-41409, \u043a\u043e\u0442\u043e\u0440\u0430\u044f, \u0432 \u0441\u0432\u043e\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c, \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043d\u0435\u043f\u043e\u043b\u043d\u044b\u043c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0434\u043b\u044f CVE-2024-52046, \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u0434\u0435\u0441\u0435\u0440\u0438\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u0430\u043d\u043d\u044b\u0445, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f RCE.\n\n\u0412\u0442\u043e\u0440\u0430\u044f - \u043d\u0435\u043f\u043e\u043b\u043d\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043b\u044f CVE-2026-41635, \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u0441\u043e\u0431\u043e\u0439 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0443\u044e \u043a \u043e\u0431\u0445\u043e\u0434\u0443 \u0441\u043f\u0438\u0441\u043a\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u043d\u044b\u0445 \u043e\u0431\u044a\u0435\u043a\u0442\u043e\u0432 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430.\n\n3. VulnCheck \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e CVE-2026-29014\u00a0(CVSS: 9,8) \u0432 CMS \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c MetInfo.\n\n\u041e\u043d\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 MetInfo CMS 7.9, 8.0 \u0438 8.1 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u044f \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0441\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c PHP-\u043a\u043e\u0434\u043e\u043c.\n\n\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u0443\u044e \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u0432\u0445\u043e\u0434\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430 \u0434\u043b\u044f RCE \u0438 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u043d\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c.", "creation_timestamp": "2026-05-06T18:50:06.000000Z"}, {"uuid": "3bf268d7-02b9-4a2a-be9e-cd03f28b7b62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28812", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrxcm7hwyh2z", "content": "CVE-2026-28812 - apache jspwiki\nApache JSPWiki versions 2.12.3 and below have a security issue that could allow attackers to gain more access than they should have. To fix this, update to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apachejspwiki #apachefoundation #CVE #infosec", "creation_timestamp": "2026-07-31T15:50:04.614358Z"}, {"uuid": "9b9dcede-b7dc-4860-9067-1b2289a3d449", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28201", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mlbep2vyur2i", "content": "CVE-2026-28201 - SurrealDB Injection on Open Notebook\nCVE ID : CVE-2026-28201\n \n Published : May 7, 2026, 11:16 a.m. | 1\u00a0hour, 9\u00a0minutes ago\n \n Description : An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 all...", "creation_timestamp": "2026-05-07T13:57:43.911993Z"}, {"uuid": "7423debb-b5dd-4ec6-8708-0e73eaec4cd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28323", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/solarwinds-security-advisory-av26-766", "content": "", "creation_timestamp": "2026-07-31T16:45:13.561971Z"}, {"uuid": "9e695ca3-b93f-492f-8a7b-d4d5f16c194a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28323", "type": "seen", "source": "https://www.ncsc.nl/alerts/kwetsbaarheid-in-solarwinds-web-help-desk-update-nu", "content": "", "creation_timestamp": "2026-07-31T16:45:18.337606Z"}, {"uuid": "e5ac676f-dd19-4d6c-8394-b55d5951ca01", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28387", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mlbteao43l2g", "content": "apigee-fluent-bit. This addresses the following vulnerabilities: CVE-2026-31789 CVE-2026-28387 N/A Security fixes for apigee-hybrid-cassandra", "creation_timestamp": "2026-05-07T18:20:12.519687Z"}, {"uuid": "e69e6578-d2dc-4d64-a230-593186fd4b96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28201", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mlc4pev2sm2w", "content": "\ud83d\udfe0 CVE-2026-28201 - High (7.8)\n\nAn improper input validation, together with an overly permissive default CORS configuration in Op...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-28201/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-07T21:07:24.636462Z"}, {"uuid": "e5b0d735-8238-4a2c-a015-690d994554a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2838", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mlcbilx2oi2g", "content": "CVE-2026-2838 whole-cart-enquiry (CVSS Score 4.4) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge", "creation_timestamp": "2026-05-07T22:33:05.501801Z"}, {"uuid": "af6fb2f9-03e9-4f0f-b9ba-370141ab70ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2892", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mldczjfcl32g", "content": "CVE-2026-2892 otter-blocks (CVSS Score 7.5) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge", "creation_timestamp": "2026-05-08T08:33:07.059929Z"}, {"uuid": "640d1d90-8b15-4b8f-92ba-78d09ad975c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28802", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3ms766gmftb2p", "content": "CVE-2026-28802 - rootio-authlib\nA security patch has been released for rootio-Authlib to prevent unauthorized access to sensitive data. This affects users of the rootio-Authlib package, who should\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#rootioauthlib #RootPyPI #CVE #infosec", "creation_timestamp": "2026-08-03T18:52:05.516048Z"}, {"uuid": "562e0adf-7337-44ce-bf0f-f1426ac6488d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28867", "type": "seen", "source": "Telegram/tcvPlgy4RT_-8DYuUczCHAOelno4AcU1hpFFn5ph0Pb3yXE", "content": "", "creation_timestamp": "2026-08-29T23:00:18.236512Z"}, {"uuid": "08f0e07f-3879-44e5-a2be-d623dddacda4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28780", "type": "seen", "source": "https://t.me/codeby_sec/10102", "content": "\ud83d\udee1Apache2 \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0442\u043e \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u043d\u043e\u0432\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043e\u043f\u0430\u0441\u043d\u0443\u044e \u0434\u044b\u0440\u0443 \u0432 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0435 HTTP/2.\n\n\u27a1\ufe0f\u0418\u0437 \u043e\u0447\u0435\u043d\u044c \u0432\u0430\u0436\u043d\u043e\u0433\u043e, \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-23918, \u0434\u0430\u044e\u0449\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (RCE) \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \"double-free\" \u0431\u0430\u0433\u0430.\n\u27a1\ufe0f\u0422\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-24072, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u043e\u043f\u0443\u0441\u043a\u0430\u043b\u0430 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u0438\u0432\u0435\u043b\u0435\u0433\u0438\u0439 \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u043b\u0430 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043c\u043e\u0434\u0443\u043b\u0438 Apache HTTP \u0432\u0435\u0440\u0441\u0438\u0439 2.4.66 \u0438 \u043d\u0438\u0436\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u043c \u0430\u0432\u0442\u043e\u0440\u0430\u043c \u0444\u0430\u0439\u043b\u043e\u0432 .htaccess \u0447\u0438\u0442\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u043f\u043e\u043b\u044c\u0437\u0432\u043e\u0430\u0442\u0435\u043b\u044f httpd.\n\u25b6\ufe0f\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-28780, \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u043a\u0443\u0447\u0435 \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 mod_proxy_ajp \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache HTTP Server. \u0415\u0441\u043b\u0438 \u043c\u043e\u0434\u0443\u043b\u044c mod_proxy_ajp \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u0441\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c AJP-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c, \u044d\u0442\u043e\u0442 \u0441\u0435\u0440\u0432\u0435\u0440 \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0432 \u043e\u0442\u0432\u0435\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0435 AJP-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435, \u0447\u0442\u043e \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u0442 \u043a \u0437\u0430\u043f\u0438\u0441\u0438 4 \u0431\u0430\u0439\u0442\u043e\u0432, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u0432\u044b\u0434\u0435\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432 \u043a\u0443\u0447\u0435 \u0431\u0443\u0444\u0435\u0440\u0430.\n\u25b6\ufe0f\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-29168, \u00ab\u0412\u044b\u0434\u0435\u043b\u0435\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u0431\u0435\u0437 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0439 \u0438\u043b\u0438 \u0440\u0435\u0433\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f\u00bb \u0432 \u043c\u043e\u0434\u0443\u043b\u0435 mod_md \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Apache HTTP Server, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0430\u044f \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u0434\u0430\u043d\u043d\u044b\u0445 OCSP-\u043e\u0442\u0432\u0435\u0442\u043e\u0432.\n\u25b6\ufe0f\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-33006, \u0410\u0442\u0430\u043a\u0430 \u043f\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043d\u0430 \u043c\u043e\u0434\u0443\u043b\u044c mod_auth_digest \u0432 Apache HTTP Server 2.4.66 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0431\u043e\u0439\u0442\u0438 Digest-\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e.\n\n\u041f\u043e\u043b\u043d\u044b\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u043c\u043e\u0436\u043d\u043e \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0437\u0434\u0435\u0441\u044c, \u043d\u043e \u043f\u0435\u0440\u0435\u0434 \u044d\u0442\u0438\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u0441\u0434\u0435\u043b\u0430\u0442\u044c:\nsudo apt update && sudo apt upgrade apache2", "creation_timestamp": "2026-05-10T10:03:56.000000Z"}, {"uuid": "775a2994-adac-4bc4-8583-24400b4018f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://t.me/cyberok_news/225", "content": "\u26d4\ufe0f \u041e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0432 SolarWinds Serv-U\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0441\u043e\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 CVE-2026-28318 \u0432 SolarWinds Serv-U \u2014 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 (FTP/SFTP) \u2014 \u0431\u044b\u043b\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u043c 03.06.2026, \u0437\u0430\u043f\u0438\u0441\u044c \u0432 NVD \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 04.06.2026. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0441 \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u043b\u0443\u0436\u0431\u044b (\u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438).\n\n\ud83d\udcca \u041c\u0430\u0441\u0448\u0442\u0430\u0431\n\u0421\u041a\u0418\u041f\u0410 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u043e\u043a\u043e\u043b\u043e ~4500 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0441 SolarWinds Serv-U, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0438\u0437\u0432\u043d\u0435 \u0432 \u0420\u0443\u043d\u0435\u0442\u0435. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u043f\u043e\u0447\u0442\u0438 \u0432\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0421\u041a\u0418\u041f\u0410 PentOps \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u044b.\n\n\ud83e\udde0 \u0410\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f\nSolarWinds Serv-U \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u0440\u0430\u0441\u0445\u043e\u0434\u0430 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0441\u043e \u0441\u0436\u0430\u0442\u0438\u0435\u043c. \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u0435\u0440\u0432\u0435\u0440 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043e \u044d\u0442\u0430\u043f\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 POST-\u0437\u0430\u043f\u0440\u043e\u0441 \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c Content-Encoding: deflate, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u00ab\u0431\u043e\u043c\u0431\u0443\u00bb \u0441\u0436\u0430\u0442\u0438\u044f (decompression bomb). \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043b\u0438\u043c\u0438\u0442\u044b \u043d\u0430 \u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438/CPU \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442, \u043f\u0440\u043e\u0446\u0435\u0441\u0441 Serv-U \u043c\u043e\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0433\u043b\u043e\u0449\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442\u0441\u044f \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e.\n\n\u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0430\u0439\u043b\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435: 5 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u043e\u043d\u0430 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 KEV \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 CISA.\n\n\ud83d\udca5 \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\u2022 \u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u043e\u0435 \u041f\u041e: SolarWinds Serv-U 15.5.4 \u0438 \u043d\u0438\u0436\u0435\n\u2022 \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e: 15.5.4 Hotfix 1\n\u2022 \u0422\u0438\u043f: \u041e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 (Denial of Service)\n\u2022 \u041a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f: CWE-400 (Uncontrolled Resource Consumption)\n\u2022 \u041a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442: \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0441 Content-Encoding: deflate\n\u2022 \u041f\u0440\u0438\u0447\u0438\u043d\u0430: \u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043b\u0438\u043c\u0438\u0442\u043e\u0432 \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 deflate-\u043f\u043e\u0442\u043e\u043a\u0430 (decompression bomb)\n\u2022 \u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438: \ud83d\udd3b \u0412\u044b\u0441\u043e\u043a\u0438\u0439 (CVSS 3.1: 7.5)\n\u2022 \u0412\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\ud83d\udd0d \u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0430\u0442\u0430\u043a\u0438\n\u2022 \u0410\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u044b\u0435 POST-\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 Serv-U \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c Content-Encoding: deflate \u2014 \u0438\u043c\u0435\u043d\u043d\u043e deflate \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u044b\u043c \u0432\u0435\u043a\u0442\u043e\u0440\u043e\u043c. \n\u2022 \u0420\u0435\u0437\u043a\u0438\u0435 \u0432\u0441\u043f\u043b\u0435\u0441\u043a\u0438 CPU/RAM \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u043c Serv-U \u043f\u0435\u0440\u0435\u0434 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u044b\u043c \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435\u043c. \n\u2022 \u0412\u043d\u0435\u0437\u0430\u043f\u043d\u044b\u0435 \u043f\u0430\u0434\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 Serv-U \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u043e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u0445. \n\u2022 \u041e\u0431\u0440\u044b\u0432\u044b \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u0438 \u0442\u0430\u0439\u043c-\u0430\u0443\u0442\u044b \u0443 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (\u043f\u043e\u0441\u043b\u0435 crash \u0441\u0435\u0440\u0432\u0438\u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d). \n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 SolarWinds Serv-U \u0434\u043e 15.5.4 Hotfix 1 \u0438\u043b\u0438 \u043d\u043e\u0432\u0435\u0435.\n\n2. \u041f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0440\u044b, \u0435\u0441\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e.  \n\u0412\u0435\u043d\u0434\u043e\u0440 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0432 Trust Center: \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0439\u0442\u0435 \u043b\u044e\u0431\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c Content-Encoding \u2014 Serv-U \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u044d\u0442\u0443 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c. \u041d\u0430\u0441\u0442\u0440\u043e\u0439\u0442\u0435 WAF/IPS \u043d\u0430 \u043f\u043e\u043b\u043d\u044b\u0439 \u0431\u043b\u043e\u043a (\u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e POST \u0438 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e deflate).\n\n3. \u041e\u0433\u0440\u0430\u043d\u0438\u0447\u044c\u0442\u0435 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f. \u041d\u0435 \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u044f\u0439\u0442\u0435 Serv-U \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u2014 VPN, \u0431\u0435\u043b\u044b\u0435 \u0441\u043f\u0438\u0441\u043a\u0438 IP, \u0441\u0442\u0440\u043e\u0433\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 FW.\n\n4. \u041f\u0440\u043e\u0432\u0435\u0440\u044c\u0442\u0435 \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b \u043f\u043e\u0441\u043b\u0435 03.06.2026.\n\n5. \u041e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c \u0432\u0435\u043d\u0434\u043e\u0440\u0430:\nhttps://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318", "creation_timestamp": "2026-08-04T13:00:19.190543Z"}, {"uuid": "eea2341f-aae6-4743-b245-03889d3bf196", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28231", "type": "seen", "source": "https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3mlla3xwbat2p", "content": "[release-25.11] python3Packages.pillow-heif: patch CVE-2026-28231\n\nhttps://github.com/NixOS/nixpkgs/pull/518910\n\n#security", "creation_timestamp": "2026-05-11T12:02:05.726346Z"}, {"uuid": "db13551f-e582-401d-b106-6bed0dfab71b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28867", "type": "seen", "source": "Telegram/tcvPlgy4RT_-8DYuUczCHAOelno4AcU1hpFFn5ph0Pb3yXE", "content": "", "creation_timestamp": "2026-08-30T00:00:26.614019Z"}, {"uuid": "6d0e6dc2-85d1-4552-8b5a-304fbf40470c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28922", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "0215f49e-261f-44a2-a82b-51682481c5d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28374", "type": "seen", "source": "https://bsky.app/profile/releaseport.com/post/3mlnxgmxk2c23", "content": "grafana 12.3.6+security-04 patches CVE-2026-28374\nEngineers benefit from critical security patches addressing CVE-2026-28374,\nUpgrade carefully.\n\n\u2192 releaseport.com/r/grafana-grafana/v12-3-6-security-04", "creation_timestamp": "2026-05-12T14:04:59.314968Z"}, {"uuid": "5883193f-4d5e-448e-8338-818e53ca6f2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28819", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "2239b5a4-8eac-4f3b-8c94-7cd5c9c0384c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28972", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "847de5a8-aa21-4ca6-bde2-b578452bb8b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28991", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "f0eea23f-866a-4d5d-8226-63ed7dd87390", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28988", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "465e589a-512b-4596-907c-45275e540a17", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28959", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "8f054531-dbe5-4777-af67-6dd08a0acbbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28995", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "cb8f8d7c-e83d-4a37-8d66-5088dba8205c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28956", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "34617c79-a793-47ac-9647-b3cda51004d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28936", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "40cd9313-e378-4cef-9735-13e1a26d7edc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28918", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "ecd117f5-0ded-48a5-a083-03904ecb62ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28878", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "6da05a46-f292-4273-a540-82202717d077", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28915", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "98565635-8377-44c3-8f43-2c6f8c6b4a6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28923", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "0afddc55-cac5-421f-8e26-839e339a55d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28943", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "be033f78-5548-4195-aaeb-c662f828f134", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28840", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "c4327737-a497-4fd2-927f-924e6baad5cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28996", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "296aa0e7-279d-437b-be94-a9db0b211413", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28919", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "c225d726-af3a-402a-973a-2aa209e7997b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28924", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "69b81c14-0e20-4240-b572-10704e3688b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28925", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "c50196d9-4e64-4d7b-86b8-7fe5bf21a2b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28985", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "7dcec121-54c6-40c9-96c9-a46b705fdc53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28977", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "9cbb1d94-7fe4-4517-bac6-f15679b9a09b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28990", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "e82a9ea4-297f-4a2a-95e4-df447be9ec30", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28908", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "7da277cf-0095-4fe5-9660-54d9dec53bef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28930", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "c3cd79b7-7f3e-4465-aba1-d43648cb05a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28978", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "fbba1b28-bbc2-436a-9e57-10df85617c23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28992", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "f0d08f4d-e9b9-4c2a-a54c-b086b5dfd512", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28983", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "9ad25fb9-95f6-4444-9f47-a66faf530f3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28906", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "5f9d3503-3bda-4da3-b09d-e2759e54e84d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28969", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "1c41c4c4-e01e-4a3e-8cad-15c75fa7f7fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28954", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "43f0d670-cf44-4327-88cf-6bbfdfa1c330", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28897", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "2426f795-354c-4b75-9f8b-4f04feca27af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "8f17214f-141b-4392-8b24-7b81b7623a3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28951", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "0974f574-8b3d-4593-87c5-c5798ab75aff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28986", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "4ebb8c1d-c459-472c-a18a-8d927c4c06fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28987", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "c2c7719e-2ea1-4005-bf11-80f1828e04cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28941", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "fdae57ed-5736-4970-96f7-060a5f08ed39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28904", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "0a12b321-fa0f-4fd3-b168-4f8551286510", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28914", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "fbdd3b38-de43-4d14-8c2a-30a29ff628ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28920", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "502355ec-6eab-4aa4-b434-f9e6fe6bc0f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28929", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "510c7a8b-cf1d-4708-b194-57f1b49c7b35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28940", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "29f83c51-168d-4f2e-8f4a-f3255514adce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28961", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "9cd33d16-8a56-4c28-983a-e94109ceeacc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28955", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "f766746a-2b4d-4435-9523-ca3b702f461c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28846", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "d8ac3312-71d2-4a25-9908-f91ccc40aa60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28993", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "048a0420-a916-4001-b262-5ef2b6a456b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28848", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "57b156b0-5032-422c-8344-d86f9bb082da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28974", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "1f68d34e-9522-4a22-ba3c-6be0650404d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28976", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "1bb09a52-0fb9-4aea-b6fa-08fec33b62ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28907", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "d21519f3-4eb5-4884-ad26-67f214020683", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28962", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "769da93d-430a-453d-b85b-9534040bc070", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28905", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "4ee41a41-5a25-4f6f-bb19-1b076eaf34f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28847", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "3723ea44-591e-4f19-9860-4a22c9734f37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28903", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "0a534f7e-40da-4d47-a330-a91055cbecfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28953", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "487b08fb-7a76-4885-919d-7100707b65bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28902", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "eb22db45-e810-4ce3-8c2f-dbd6e79e9e32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28901", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "35b8bb23-0938-4e21-adb5-a9c0ff28a1ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28913", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "0f57f8a9-da8d-485d-aa5d-8749521ee445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28883", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "29f1dba8-29e1-4414-9ce5-a2cccc185d0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28958", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "7fcb47aa-f958-4d21-95b8-ad0de72b86ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28946", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "e5f76678-5468-4a41-87c9-5fbcff569533", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28942", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "a8f3b140-f3d1-4efc-9a04-05608217120e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28917", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "bcfdb4af-6060-45f0-9900-01db3070eacc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28947", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "24cfd2b9-c301-4553-bc43-af35e9f65b14", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28971", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "c1e7f1fe-1fe0-4126-b0bc-cc315be3d2d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28944", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "86bf40fe-1921-429f-85b0-3f53d9732c0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28994", "type": "seen", "source": "https://www.thezdi.com/blog/2026/5/12/the-apple-macos-security-update-review", "content": "We\u2019ve received some feedback from those who read the Patch Blog that they would like something similar for macOS updates. Unfortunately, Apple doesn\u2019t schedule these for a particular day, but we can provide our thoughts and analysis on the days they do release their latest patches. \nFor May 2026, Apple released 82 unique CVEs across the three macOS versions: 79 for macOS Tahoe 26.5, 45 for macOS Sequoia 15.7.7, and 42 for macOS Sonoma 14.8.7. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. However, there are a couple that stand out.\n-              CVE-2026-28819 (Wi-Fi) stands out as the strongest candidate for the most severe as it states, \u201cAn app may be able to execute arbitrary code with kernel privileges.\u201d The combination of arbitrary code execution at the kernel level is about as bad as it gets on a severity scale. Plus, it affects all three macOS versions (Tahoe, Sequoia, and Sonoma).\n-              CVE-2026-43668 (mDNSResponder) also piques my interest since, \u201cA remote attacker may be able to cause unexpected system termination or corrupt kernel memory.\u201d The remote attack vector with kernel memory corruption on all three OS versions makes this a serious one, especially since mDNSResponder is always running.\n-              CVE-2026-28972 (Kernel) This one states that \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d An out-of-bounds write directly into kernel memory on all three OS versions. This one may also have implications in the upcoming Pwn2Own Berlin contest.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n    \n\n\n  82Unique CVEs\n  79macOS Tahoe 26.5\n  45macOS Sequoia 15.7.7\n  42macOS Sonoma 14.8.7\n\n\n\n\n<colgroup>\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n  <col />\n</colgroup>\n\n\n  \n    CVE ID\n    Component\n    Impact\n    macOS Tahoe 26.5\n    macOS Sequoia 15.7.7\n    macOS Sonoma 14.8.7\n  \n\n\n  \n    CVE-2026-28991\n    Accelerate\n    An app may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28988\n    Accounts\n    An app may be able to bypass certain Privacy preferences\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28959\n    APFS\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28995\n    App Intents\n    A malicious app may be able to break out of its sandbox\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-1837\n    AppleJPEG\n    Processing a maliciously crafted image may lead to a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28956\n    AppleJPEG\n    Processing a maliciously crafted media file may lead to unexpected app termination or corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39869\n    Audio\n    Processing an audio stream in a maliciously crafted media file may terminate the process\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28922\n    CoreMedia\n    An app may be able to access private information\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28936\n    CoreServices\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28918\n    CoreSymbolication\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28878\n    Crash Reporter\n    An app may be able to enumerate a user's installed apps\n    No\n    Yes\n    No\n  \n  \n    CVE-2026-28915\n    CUPS\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43659\n    FileProvider\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28923\n    GPU Drivers\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28925\n    HFS\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2025-43524\n    Icons\n    An app may be able to break out of its sandbox\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43661\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28977\n    ImageIO\n    Processing a maliciously crafted file may lead to unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28990\n    ImageIO\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28978\n    Installer\n    A malicious app may be able to break out of its sandbox\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28992\n    IOHIDFamily\n    An attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28943\n    IOHIDFamily\n    An app may be able to determine kernel memory layout\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28969\n    IOKit\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43655\n    IOSurfaceAccelerator\n    An app may be able to cause unexpected system termination or read kernel memory\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43654\n    Kernel\n    An app may be able to disclose kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28908\n    Kernel\n    An app may be able to modify protected parts of the file system\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28954\n    Kernel\n    A maliciously crafted disk image may bypass Gatekeeper checks\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28897\n    Kernel\n    A local user may be able to cause unexpected system termination or read kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28952\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28951\n    Kernel\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28972\n    Kernel\n    An app may be able to cause unexpected system termination or write kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28986\n    Kernel\n    An app may be able to cause unexpected system termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28987\n    Kernel\n    An app may be able to leak sensitive kernel state\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28983\n    LaunchServices\n    A remote attacker may be able to cause a denial of service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28929\n    Mail Drafts\n    Replying to an email could display remote images in Mail in Lockdown Mode\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43653\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    Yes\n  \n  \n    CVE-2026-28985\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43668\n    mDNSResponder\n    A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43666\n    mDNSResponder\n    An attacker on the local network may be able to cause a denial-of-service\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28941\n    Model I/O\n    Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28940\n    Model I/O\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28961\n    Network Extensions\n    An attacker with physical access to a locked device may be able to view sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28906\n    Networking\n    An attacker may be able to track users through their IP address\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28840\n    PackageKit\n    An app may be able to gain root privileges\n    No\n    Yes\n    Yes\n  \n  \n    CVE-2026-43656\n    Quick Look\n    Parsing a maliciously crafted file may lead to an unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-43652\n    Sandbox\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-39870\n    SceneKit\n    Processing a maliciously crafted image may corrupt process memory\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28846\n    SceneKit\n    A remote attacker may be able to cause unexpected app termination\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28993\n    Shortcuts\n    An app may be able to access user-sensitive data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28848\n    SMB\n    A remote attacker may be able to cause unexpected system termination\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28930\n    Spotlight\n    An app may be able to access protected user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28974\n    Spotlight\n    An app may be able to cause a denial-of-service\n    Yes\n    Yes\n    No\n  \n  \n    CVE-2026-28996\n    Storage\n    An app may be able to access sensitive user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28919\n    StorageKit\n    An app may be able to gain root privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28924\n    Sync Services\n    An app may be able to access Contacts without user consent\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-39871\n    TV App\n    An app may be able to observe unprotected user data\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28976\n    UserAccountUpdater\n    An app may be able to gain root privileges\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43660\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28907\n    WebKit\n    Processing maliciously crafted web content may prevent Content Security Policy from being enforced\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28962\n    WebKit\n    Processing maliciously crafted web content may disclose sensitive user information\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-43658\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28905\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28847\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28904\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28955\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28903\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28953\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28902\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28901\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28913\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28883\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28958\n    WebKit\n    An app may be able to access sensitive user data\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28917\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28947\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28946\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28942\n    WebKit\n    Processing maliciously crafted web content may lead to an unexpected Safari crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28971\n    WebKit\n    A malicious iframe may use another website's download settings\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28944\n    WebRTC\n    Processing maliciously crafted web content may lead to an unexpected process crash\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28819\n    Wi-Fi\n    An app may be able to execute arbitrary code with kernel privileges\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28994\n    Wi-Fi\n    An attacker in a privileged network position may be able to perform denial-of-service attack using crafted Wi-Fi packets\n    Yes\n    Yes\n    Yes\n  \n  \n    CVE-2026-28914\n    zip\n    A maliciously crafted ZIP archive may bypass Gatekeeper checks\n    Yes\n    No\n    No\n  \n  \n    CVE-2026-28920\n    zlib\n    Visiting a maliciously crafted website may leak sensitive data\n    Yes\n    Yes\n    Yes\n  \n\n\n\n\n\n  \n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft. ", "creation_timestamp": "2026-05-12T10:21:51.000000Z"}, {"uuid": "ba55f16e-acfc-4005-9f82-2ce8dc676342", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28972", "type": "seen", "source": "https://bsky.app/profile/xint-io.bsky.social/post/3mlo7d2kl6k2a", "content": "Here is a brief overview of two kernel-level vulnerabilities uncovered by Xint Code in iOS and iPadOS and now patched: CVE-2026-28972 and CVE-2026-28986\nxint.io/blog/kernel-...", "creation_timestamp": "2026-05-12T16:26:10.505827Z"}, {"uuid": "21d465bc-a4dd-4318-94bf-e51f35ccc7d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28986", "type": "seen", "source": "https://bsky.app/profile/xint-io.bsky.social/post/3mlo7d2kl6k2a", "content": "Here is a brief overview of two kernel-level vulnerabilities uncovered by Xint Code in iOS and iPadOS and now patched: CVE-2026-28972 and CVE-2026-28986\nxint.io/blog/kernel-...", "creation_timestamp": "2026-05-12T16:26:10.743628Z"}, {"uuid": "abe88c36-fe37-4b67-8e03-d6116871a38a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28374", "type": "seen", "source": "https://bsky.app/profile/releaseport.com/post/3mlozakkufh2g", "content": "grafana 11.6.14+security-04 patches CVE-2026-28374\nSecurity updates address multiple critical vulnerabilities (CVE-2026-28374, 28376, 28383).\nUpgrade carefully.\n\n\u2192 releaseport.com/r/grafana-grafana/v11-6-14-security-04", "creation_timestamp": "2026-05-13T00:10:05.034699Z"}, {"uuid": "bb04e6e1-7d0d-4404-acd8-93c72775d00f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28906", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116564523214498003", "content": "It is possible to see elevated activities targeting Apple iOS and other products (CVE-2026-28906) https://vuldb.com/vuln/362812/cti", "creation_timestamp": "2026-05-13T00:51:18.452755Z"}, {"uuid": "0add159f-c3cd-49ac-9f4d-7c64805f27fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28920", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "8e2d8883-5579-4773-a44e-b4ba5153a1ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28922", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "8f5ad584-6238-44a6-aa49-c18472fe8f80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28923", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "db3cc17f-58cf-4fc4-8eb8-fe3eb1de1802", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28924", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "a91bb404-b8df-4a08-be95-069bfd22db6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28925", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "0e6d4f50-2ba2-4b25-895a-c7972cf7d849", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28929", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "d04d9042-ef36-4651-ae15-743e768b2519", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28930", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "0f10c6a0-89dd-4dc2-8e98-d1d38cd915c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28919", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "2fff1576-961b-4183-85ba-a06a87240220", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28819", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "2e3a5f89-2b07-453e-9117-fb7e8ab25b92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28840", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "6daf53bb-79d7-47ae-afce-d7a3dcef224f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28846", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "2ce6487b-0a3d-4ff9-a83c-55dadb743818", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28847", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "b5e166a9-b1ca-4610-bb43-0678595ca52a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28848", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "b96c7d72-98aa-4bec-8ede-29466df0fecf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28870", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "5d618ff3-6829-45c4-a153-13d203b6e928", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28872", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "b84d7944-71d2-4372-80bc-7f5fe96d2c08", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28873", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "62946189-643f-4d6c-8626-522440145afb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28877", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "8d0d3b68-d7c9-463f-9183-2a91d6b3178b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28878", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "43fafa15-2d7f-43b3-91c0-a8ccc9a9ae82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28882", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "091540b0-c9b9-4499-90d1-bbe168bceef5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28883", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "04a1d5b2-9c06-4a3c-ac02-3bfc1d131122", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28894", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "d3545048-0a15-4c9d-af57-2daeba542927", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28897", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "cc7efc86-60a0-4893-8705-1d82226e38b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28901", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "a02fa20f-db0c-4116-a1d0-0e017dc553c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28902", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "c087ba83-e06f-4afd-b1b0-fbcf2576744e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28903", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "45568640-59aa-455e-91b3-8baed32a72c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28904", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "f846fc89-6fcd-4623-82a5-e09fea74d4d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28905", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "b4d55828-9c72-4b13-b773-00c208052562", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28906", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "d0c5f32d-cbf7-45ee-937d-92e956760421", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28907", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "cebf593f-7ca2-4140-a635-b1443b9fcbdb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28908", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "87e85c20-7c50-45c4-ace0-7914c165f005", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28913", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "f2d6a5fc-4cec-44f7-be73-894f121c615a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28914", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "de23ad72-8b13-4cb8-acf9-82d21d2040fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28915", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "24f13d78-1ab9-44ec-8e8c-0258ba8e0692", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28917", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "7b3a27b8-bc11-4bcd-af8d-4fded7d0a904", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28918", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "ef2d7548-e9cf-42f7-b6aa-c1190bd87963", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28936", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "8c929858-4585-459a-bc45-c114e0a9111f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28944", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "8a7f4104-fa2e-4489-b52f-e09ca38afb1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28954", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "1e663e34-d3f8-4dcb-a344-1f1ecce77256", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28955", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "0f801db5-718c-4f4c-8407-a710a6d7fc22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28940", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "d4bf96d0-0374-43fd-a18c-b3606fcca41d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28941", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "7e716068-25ee-47cb-aa4d-c1a495b19f3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28946", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "f9df7089-0a8d-4986-82d7-4f2a61baa0a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28953", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "9af1f22c-6b6d-41b8-bad1-969247f72203", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28942", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "f5d99017-31d4-4610-a2a0-86e69087d20a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28943", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "33fc29da-3e61-4c14-be63-0b3ef305ab5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28947", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "811e1398-b823-494a-b379-17e75ef4a655", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "fed7d801-02f2-43af-92ee-2dd629b4f89d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28974", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "090965d5-fd01-483b-8535-4f398e8910ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28951", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "175f4b6e-c395-4bf5-a2c4-e39a3ab25c32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "30915758-ee3a-44c6-8810-eeca3af787ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28956", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "c230e495-7aeb-48a9-8205-316350548cd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28957", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "5d3bb9b6-a73f-4741-9689-3a61b90507a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28958", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "6d579e76-5eb5-44b1-82a7-9a81ce5eb2e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28959", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "e009ff62-79fe-4fdb-9135-f5b4488c3aba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28961", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "2a32d30b-1066-4213-be27-f0c4aff9171f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28962", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "880f7f24-d6b5-46a8-9cb3-b944d2b3422a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28963", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "82af3327-cadd-4e46-872a-55641eb8831e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28964", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "6d12260d-73d8-4901-845b-ce760a7dd0f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28965", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "4b625d69-b2c1-4e90-9b49-b41ec398773d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28969", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "c08dbf37-1835-4d54-a696-30d4eec2f50e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28971", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "ebd0b303-843b-42ad-be5e-facce9b96dd1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28978", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "9a141601-4585-46e8-9fce-43fdc8afb3cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28983", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "05468d87-28e5-4e59-b842-b3eec4aa9a36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28985", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "61788652-9226-4e5a-a295-5e58a79eb474", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28990", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "662ea61d-214f-4a73-9aa0-efee77e912bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28991", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "09ab0eab-d2c7-499b-89aa-45927ef1e3bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28992", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "01be3cc5-7693-4565-8cd7-9690f0cb995a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28995", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "df9ffa67-16f0-4ee0-a84b-128fc6a1ddc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28972", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "8e07842f-6f97-461b-81fe-ee0711212b0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28994", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "472089e1-5ac2-4ba5-9d74-0ec0ba0f6bdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28976", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "c100f2fa-d4b4-428d-bf1a-87878b46493e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28977", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "c0581951-363a-4eeb-93f3-329cfae627f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28986", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "8b3cba7b-357a-4263-bd23-db8d0cd5ff41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28987", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "787890d9-59d3-4428-a3f2-0c9373cf01d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28988", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "e9367577-aeb6-4f3a-b93c-fd088d3277cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28993", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "c8d2a565-3ac7-423c-a73a-ce0a2f225562", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28996", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260513", "content": "", "creation_timestamp": "2026-05-12T18:00:00.000000Z"}, {"uuid": "91476def-cf85-407e-9ae8-780dc70e3dfe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28291", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mlrqatpoi22y", "content": "\ud83d\udccc CVE-2026-28291 - simple-git enables running native Git commands from JavaScript. Versions up to and including 3.31.1 allow execution of arbitrary commands through Git ... https://www.cyberhub.blog/cves/CVE-2026-28291", "creation_timestamp": "2026-05-14T02:07:07.660477Z"}, {"uuid": "d65ef91c-4fa8-4676-84af-06305cd44921", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28215", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mlryutlipp2e", "content": "\ud83d\udfe0 CVE-2026-44478 - High (7.5)\n\nhoppscotch is an open source API development ecosystem. The fix for CVE-2026-28215 in version 202...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-44478/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-14T04:41:29.354395Z"}, {"uuid": "e13c8f26-68fb-4d06-8471-80b3f4c1bda7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2828", "type": "seen", "source": "Telegram/snqalfjRGyeCByylJf6ek_8lwbWnhtUi9PGLk9MnmWsBvV0", "content": "", "creation_timestamp": "2026-08-03T08:00:03.376925Z"}, {"uuid": "3ce73bf2-0ef1-4984-863b-15b1ea4b381e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28387", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10", "content": "View CSAF\n\nSummary\n\nSIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.\n\nThe following versions of Siemens SIMATIC are affected:\n\n\n\nSIMATIC CN 4100 vers:intdot/<5.0 \n\n<div class=\"csaf-table\">\n\n\n\n\nCVSS\nVendor\nEquipment\nVulnerabilities\n\n\n\n\nv3 9.6\nSiemens\nSiemens SIMATIC\nNULL Pointer Dereference, Reachable Assertion, Use After Free, Out-of-bounds Write, Integer Overflow or Wraparound, Allocation of Resources Without Limits or Throttling, Out-of-bounds Read, Covert Timing Channel, Stack-based Buffer Overflow, Inefficient Algorithmic Complexity, Missing Release of Memory after Effective Lifetime, Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Input Validation, Improper Locking, Uncontrolled Recursion, Buffer Access with Incorrect Length Value, Race Condition within a Thread, Missing Synchronization, Use of Uninitialized Resource, Double Free, Missing Release of Resource after Effective Lifetime, Loop with Unreachable Exit Condition ('Infinite Loop'), Improper Update of Reference Count, Improper Control of a Resource Through its Lifetime, Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), Unexpected Status Code or Return Value, Divide By Zero, Improper Validation of Specified Index, Position, or Offset in Input, Comparison Using Wrong Factors, Observable Timing Discrepancy, Improper Validation of Syntactic Correctness of Input, Deadlock, Signal Handler Race Condition, Improper Following of Specification by Caller, Improper Check for Dropped Privileges, Transmission of Private Resources into a New Sphere ('Resource Leak'), Improper Resource Shutdown or Release, Improper Access Control, Exposure of Sensitive Information to an Unauthorized Actor, Relative Path Traversal, Improper Neutralization of Escape, Meta, or Control Sequences, Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade'), Uncontrolled Resource Consumption, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Missing Authentication for Critical Function, Improper Check for Unusual or Exceptional Conditions\n\n\n\n</div>\n\nBackground\n\n\n\nCritical Infrastructure Sectors: Critical Manufacturing\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: Germany\n\n\n\n\nVulnerabilities\n<div class=\"csaf-accordion\">\n\nExpand All +\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-47704\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check link_res->hpo_dp_link_enc before using it [WHAT & HOW] Functions dp_enable_link_phy and dp_disable_link_phy can pass link_res without initializing hpo_dp_link_enc and it is necessary to check for null before dereferencing. This fixes 2 FORWARD_NULL issues reported by Coverity.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-57924\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding file handles is usually performed by a filesystem >encode_fh() method that may fail for various reasons. The legacy users of exportfs_encode_fh(), namely, nfsd and name_to_handle_at(2) syscall are ready to cope with the possibility of failure to encode a file handle. There are a few other users of exportfs_encode_{fh,fid}() that currently have a WARN_ON() assertion when ->encode_fh() fails. Relax those assertions because they are wrong. The second linked bug report states commit 16aac5ad1fa9 (\"ovl: support encoding non-decodable file handles\") in v6.6 as the regressing commit, but this is not accurate. The aforementioned commit only increases the chances of the assertion and allows triggering the assertion with the reproducer using overlayfs, inotify and drop_caches. Triggering this assertion was always possible with other filesystems and other reasons of ->encode_fh() failures and more particularly, it was also possible with the exact same reproducer using overlayfs that is mounted with options index=on,nfs_export=on also on kernels < v6.6. Therefore, I am not listing the aforementioned commit as a Fixes commit. Backport hint: this patch will have a trivial conflict applying to v6.6.y, and other trivial conflicts applying to stable kernels < v6.6.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-617 Reachable Assertion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-58240\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result. We should preferably also use a separate crypto_wait. I'm not seeing a UAF as I did in the past, I think aec7961916f3 (\"tls: fix race between async notify and socket close\") took care of it. This will make the next fix easier.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.3\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-6021\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-6052\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in how GLib\u2019s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn\u2019t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-190 Integer Overflow or Wraparound\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.7\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-7425\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-8916\n<div class=\"csaf-accordion-content\">\n\nAllocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9230\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9231\n<div class=\"csaf-accordion-content\">\n\nIssue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is possible to add support for such certificates via a custom provider, coupled with the fact that in such a custom provider context the private key may be recoverable via remote timing measurements, we consider this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as SM2 is not an approved algorithm.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-385 Covert Timing Channel\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9232\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9820\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-121 Stack-based Buffer Overflow\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-14831\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-407 Inefficient Algorithmic Complexity\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-23143\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. When I ran the repro [0] and waited a few seconds, I observed two LOCKDEP splats: a warning immediately followed by a null-ptr-deref. [1] Reproduction Steps: 1) Mount CIFS 2) Add an iptables rule to drop incoming FIN packets for CIFS 3) Unmount CIFS 4) Unload the CIFS module 5) Remove the iptables rule At step 3), the CIFS module calls sock_release() for the underlying TCP socket, and it returns quickly. However, the socket remains in FIN_WAIT_1 because incoming FIN packets are dropped. At this point, the module's refcnt is 0 while the socket is still alive, so the following rmmod command succeeds. # ss -tan State Recv-Q Send-Q Local Address:Port Peer Address:Port FIN-WAIT-1 0 477 10.0.2.15:51062 10.0.0.137:445 # lsmod | grep cifs cifs 1159168 0 This highlights a discrepancy between the lifetime of the CIFS module and the underlying TCP socket. Even after CIFS calls sock_release() and it returns, the TCP socket does not die immediately in order to close the connection gracefully. While this is generally fine, it causes an issue with LOCKDEP because CIFS assigns a different lock class to the TCP socket's sk->sk_lock using sock_lock_init_class_and_name(). Once an incoming packet is processed for the socket or a timer fires, sk->sk_lock is acquired. Then, LOCKDEP checks the lock context in check_wait_context(), where hlock_class() is called to retrieve the lock class. However, since the module has already been unloaded, hlock_class() logs a warning and returns NULL, triggering the null-ptr-deref. If LOCKDEP is enabled, we must ensure that a module calling sock_lock_init_class_and_name() (CIFS, NFS, etc) cannot be unloaded while such a socket is still alive to prevent this issue. Let's hold the module reference in sock_lock_init_class_and_name() and release it when the socket is freed in sk_prot_free(). Note that sock_lock_init() clears sk->sk_owner for svc_create_socket() that calls sock_lock_init_class_and_name() for a listening socket, which clones a socket by sk_clone_lock() without GFP_ZERO. [0]: CIFS_SERVER=\"10.0.0.137\" CIFS_PATH=\"//${CIFS_SERVER}/Users/Administrator/Desktop/CIFS_TEST\" DEV=\"enp0s3\" CRED=\"/root/WindowsCredential.txt\" MNT=$(mktemp -d /tmp/XXXXXX) mount -t cifs ${CIFS_PATH} ${MNT} -o vers=3.0,credentials=${CRED},cache=none,echo_interval=1 iptables -A INPUT -s ${CIFS_SERVER} -j DROP for i in $(seq 10); do umount ${MNT} rmmod cifs sleep 1 done rm -r ${MNT} iptables -D INPUT -s ${CIFS_SERVER} -j DROP [1]: DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 10 PID: 0 at kernel/locking/lockdep.c:234 hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223) Modules linked in: cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs] CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Not tainted 6.14.0 #36 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223) ... Call Trace: __lock_acquire (kernel/locking/lockdep.c:4853 kernel/locking/lockdep.c:5178) lock_acquire (kernel/locking/lockdep.c:469 kernel/locking/lockdep.c:5853 kernel/locking/lockdep.c:5816) _raw_spin_lock_nested (kernel/locking/spinlock.c:379) tcp_v4_rcv (./include/linux/skbuff.h:1678 ./include/net/tcp.h:2547 net/ipv4/tcp_ipv4.c:2350) ... BUG: kernel NULL pointer dereference, address: 00000000000000c4 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Tainted: G W 6.14.0 #36 Tainted: [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__lock_acquire (kernel/ ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-23160\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization On Mediatek devices with a system companion processor (SCP) the mtk_scp structure has to be removed explicitly to avoid a resource leak. Free the structure in case the allocation of the firmware structure fails during the firmware initialization.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-31257\n<div class=\"csaf-accordion-content\">\n\nThis issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-37931\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: adjust subpage bit start based on sectorsize When running machines with 64k page size and a 16k nodesize we started seeing tree log corruption in production. This turned out to be because we were not writing out dirty blocks sometimes, so this in fact affects all metadata writes. When writing out a subpage EB we scan the subpage bitmap for a dirty range. If the range isn't dirty we do bit_start++; to move onto the next bit. The problem is the bitmap is based on the number of sectors that an EB has. So in this case, we have a 64k pagesize, 16k nodesize, but a 4k sectorsize. This means our bitmap is 4 bits for every node. With a 64k page size we end up with 4 nodes per page. To make this easier this is how everything looks [0 16k 32k 48k ] logical address [0 4 8 12 ] radix tree offset [ 64k page ] folio [ 16k eb ][ 16k eb ][ 16k eb ][ 16k eb ] extent buffers [ | | | | | | | | | | | | | | | | ] bitmap Now we use all of our addressing based on fs_info->sectorsize_bits, so as you can see the above our 16k eb->start turns into radix entry 4. When we find a dirty range for our eb, we correctly do bit_start += sectors_per_node, because if we start at bit 0, the next bit for the next eb is 4, to correspond to eb->start 16k. However if our range is clean, we will do bit_start++, which will now put us offset from our radix tree entries. In our case, assume that the first time we check the bitmap the block is not dirty, we increment bit_start so now it == 1, and then we loop around and check again. This time it is dirty, and we go to find that start using the following equation start = folio_start + bit_start * fs_info->sectorsize; so in the case above, eb->start 0 is now dirty, and we calculate start as 0 + 1 * fs_info->sectorsize = 4096 4096 >> 12 = 1 Now we're looking up the radix tree for 1, and we won't find an eb. What's worse is now we're using bit_start == 1, so we do bit_start += sectors_per_node, which is now 5. If that eb is dirty we will run into the same thing, we will look at an offset that is not populated in the radix tree, and now we're skipping the writeout of dirty extent buffers. The best fix for this is to not use sectorsize_bits to address nodes, but that's a larger change. Since this is a fs corruption problem fix it simply by always using sectors_per_node to increment the start bit.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-37968\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: light: opt3001: fix deadlock due to concurrent flag access The threaded IRQ function in this driver is reading the flag twice: once to lock a mutex and once to unlock it. Even though the code setting the flag is designed to prevent it, there are subtle cases where the flag could be true at the mutex_lock stage and false at the mutex_unlock stage. This results in the mutex not being unlocked, resulting in a deadlock. Fix it by making the opt3001_irq() code generally more robust, reading the flag into a variable and using the variable value at both stages.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38322\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Hardware name: Dell Inc. Precision 9660/0VJ762 RIP: 0010:native_read_pmc+0x7/0x40 Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP: 000:fffb03100273de8 EFLAGS: 00010046 .... Call Trace: icl_update_topdown_event+0x165/0x190 ? ktime_get+0x38/0xd0 intel_pmu_read_event+0xf9/0x210 __perf_event_read+0xf9/0x210 CPUs 16-23 are E-core CPUs that don't support the perf metrics feature. The icl_update_topdown_event() should not be invoked on these CPUs. It's a regression of commit: f9bdf1f95339 (\"perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read\") The bug introduced by that commit is that the is_topdown_event() function is mistakenly used to replace the is_topdown_count() call to check if the topdown functions for the perf metrics feature should be invoked. Fix it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38347\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on ino and xnid syzbot reported a f2fs bug as below: INFO: task syz-executor140:5308 blocked for more than 143 seconds. Not tainted 6.14.0-rc7-syzkaller-00069-g81e4f8d68c66 #0 \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message. task:syz-executor140 state:D stack:24016 pid:5308 tgid:5308 ppid:5306 task_flags:0x400140 flags:0x00000006 Call Trace: context_switch kernel/sched/core.c:5378 [inline] __schedule+0x190e/0x4c90 kernel/sched/core.c:6765 __schedule_loop kernel/sched/core.c:6842 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6857 io_schedule+0x8d/0x110 kernel/sched/core.c:7690 folio_wait_bit_common+0x839/0xee0 mm/filemap.c:1317 __folio_lock mm/filemap.c:1664 [inline] folio_lock include/linux/pagemap.h:1163 [inline] __filemap_get_folio+0x147/0xb40 mm/filemap.c:1917 pagecache_get_page+0x2c/0x130 mm/folio-compat.c:87 find_get_page_flags include/linux/pagemap.h:842 [inline] f2fs_grab_cache_page+0x2b/0x320 fs/f2fs/f2fs.h:2776 __get_node_page+0x131/0x11b0 fs/f2fs/node.c:1463 read_xattr_block+0xfb/0x190 fs/f2fs/xattr.c:306 lookup_all_xattrs fs/f2fs/xattr.c:355 [inline] f2fs_getxattr+0x676/0xf70 fs/f2fs/xattr.c:533 __f2fs_get_acl+0x52/0x870 fs/f2fs/acl.c:179 f2fs_acl_create fs/f2fs/acl.c:375 [inline] f2fs_init_acl+0xd7/0x9b0 fs/f2fs/acl.c:418 f2fs_init_inode_metadata+0xa0f/0x1050 fs/f2fs/dir.c:539 f2fs_add_inline_entry+0x448/0x860 fs/f2fs/inline.c:666 f2fs_add_dentry+0xba/0x1e0 fs/f2fs/dir.c:765 f2fs_do_add_link+0x28c/0x3a0 fs/f2fs/dir.c:808 f2fs_add_link fs/f2fs/f2fs.h:3616 [inline] f2fs_mknod+0x2e8/0x5b0 fs/f2fs/namei.c:766 vfs_mknod+0x36d/0x3b0 fs/namei.c:4191 unix_bind_bsd net/unix/af_unix.c:1286 [inline] unix_bind+0x563/0xe30 net/unix/af_unix.c:1379 __sys_bind_socket net/socket.c:1817 [inline] __sys_bind+0x1e4/0x290 net/socket.c:1848 __do_sys_bind net/socket.c:1853 [inline] __se_sys_bind net/socket.c:1851 [inline] __x64_sys_bind+0x7a/0x90 net/socket.c:1851 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Let's dump and check metadata of corrupted inode, it shows its xattr_nid is the same to its i_ino. dump.f2fs -i 3 chaseyu.img.raw i_xattr_nid [0x 3 : 3] So that, during mknod in the corrupted directory, it tries to get and lock inode page twice, result in deadlock. - f2fs_mknod - f2fs_add_inline_entry - f2fs_get_inode_page --- lock dir's inode page - f2fs_init_acl - f2fs_acl_create(dir,..) - __f2fs_get_acl - f2fs_getxattr - lookup_all_xattrs - __get_node_page --- try to lock dir's inode page In order to fix this, let's add sanity check on ino and xnid.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38491\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mptcp: make fallback action and fallback decision atomic Syzkaller reported the following splat: WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 check_fully_established net/mptcp/options.c:982 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Modules linked in: CPU: 1 UID: 0 PID: 7704 Comm: syz.3.1419 Not tainted 6.16.0-rc3-gbd5ce2324dba #20 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] RIP: 0010:mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] RIP: 0010:check_fully_established net/mptcp/options.c:982 [inline] RIP: 0010:mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Code: 24 18 e8 bb 2a 00 fd e9 1b df ff ff e8 b1 21 0f 00 e8 ec 5f c4 fc 44 0f b7 ac 24 b0 00 00 00 e9 54 f1 ff ff e8 d9 5f c4 fc 90 <0f> 0b 90 e9 b8 f4 ff ff e8 8b 2a 00 fd e9 8d e6 ff ff e8 81 2a 00 RSP: 0018:ffff8880a3f08448 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880180a8000 RCX: ffffffff84afcf45 RDX: ffff888090223700 RSI: ffffffff84afdaa7 RDI: 0000000000000001 RBP: ffff888017955780 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880180a8910 R14: ffff8880a3e9d058 R15: 0000000000000000 FS: 00005555791b8500(0000) GS:ffff88811c495000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c2800b7 CR3: 0000000058e44000 CR4: 0000000000350ef0 Call Trace: tcp_reset+0x26f/0x2b0 net/ipv4/tcp_input.c:4432 tcp_validate_incoming+0x1057/0x1b60 net/ipv4/tcp_input.c:5975 tcp_rcv_established+0x5b5/0x21f0 net/ipv4/tcp_input.c:6166 tcp_v4_do_rcv+0x5dc/0xa70 net/ipv4/tcp_ipv4.c:1925 tcp_v4_rcv+0x3473/0x44a0 net/ipv4/tcp_ipv4.c:2363 ip_protocol_deliver_rcu+0xba/0x480 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2f1/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_local_deliver+0x1be/0x560 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:469 [inline] ip_rcv_finish net/ipv4/ip_input.c:447 [inline] NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_rcv+0x514/0x810 net/ipv4/ip_input.c:567 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5975 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6088 process_backlog+0x301/0x1360 net/core/dev.c:6440 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7453 napi_poll net/core/dev.c:7517 [inline] net_rx_action+0xb44/0x1010 net/core/dev.c:7644 handle_softirqs+0x1d0/0x770 kernel/softirq.c:579 do_softirq+0x3f/0x90 kernel/softirq.c:480 __local_bh_enable_ip+0xed/0x110 kernel/softirq.c:407 local_bh_enable include/linux/bottom_half.h:33 [inline] inet_csk_listen_stop+0x2c5/0x1070 net/ipv4/inet_connection_sock.c:1524 mptcp_check_listen_stop.part.0+0x1cc/0x220 net/mptcp/protocol.c:2985 mptcp_check_listen_stop net/mptcp/mib.h:118 [inline] __mptcp_close+0x9b9/0xbd0 net/mptcp/protocol.c:3000 mptcp_close+0x2f/0x140 net/mptcp/protocol.c:3066 inet_release+0xed/0x200 net/ipv4/af_inet.c:435 inet6_release+0x4f/0x70 net/ipv6/af_inet6.c:487 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x402/0xb70 fs/file_table.c:465 task_work_run+0x150/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xd4 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38502\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: bpf: Fix oob access in cgroup local storage Lonial reported that an out-of-bounds access in cgroup local storage can be crafted via tail calls. Given two programs each utilizing a cgroup local storage with a different value size, and one program doing a tail call into the other. The verifier will validate each of the indivial programs just fine. However, in the runtime context the bpf_cg_run_ctx holds an bpf_prog_array_item which contains the BPF program as well as any cgroup local storage flavor the program uses. Helpers such as bpf_get_local_storage() pick this up from the runtime context: ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx); storage = ctx->prog_item->cgroup_storage[stype]; if (stype == BPF_CGROUP_STORAGE_SHARED) ptr = &READ_ONCE(storage->buf)->data[0]; else ptr = this_cpu_ptr(storage->percpu_buf); For the second program which was called from the originally attached one, this means bpf_get_local_storage() will pick up the former program's map, not its own. With mismatching sizes, this can result in an unintended out-of-bounds access. To fix this issue, we need to extend bpf_map_owner with an array of storage_cookie[] to match on i) the exact maps from the original program if the second program was using bpf_get_local_storage(), or ii) allow the tail call combination if the second program was not using any of the cgroup local storage maps.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38552\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between subflow fail and subflow creation We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are just harder to trigger. The solution is similar. Use a separate flag to track the condition 'socket state prevent any additional subflow creation' protected by the fallback lock. The socket fallback makes such flag true, and also receiving or sending an MP_FAIL option. The field 'allow_infinite_fallback' is now always touched under the relevant lock, we can drop the ONCE annotation on write.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38614\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the depth of the resulting tree for two reasons: - They don't look upwards in the tree. - If there are multiple downwards paths of different lengths, only one of the paths is actually considered for the depth check since commit 28d82dc1c4ed (\"epoll: limit paths\"). Essentially, the current recursion depth check in ep_loop_check_proc() just serves to prevent it from recursing too deeply while checking for loops. A more thorough check is done in reverse_path_check() after the new graph edge has already been created; this checks, among other things, that no paths going upwards from any non-epoll file with a length of more than 5 edges exist. However, this check does not apply to non-epoll files. As a result, it is possible to recurse to a depth of at least roughly 500, tested on v6.15. (I am unsure if deeper recursion is possible; and this may have changed with commit 8c44dac8add7 (\"eventpoll: Fix priority inversion problem\").) To fix it: 1. In ep_loop_check_proc(), note the subtree depth of each visited node, and use subtree depths for the total depth calculation even when a subtree has already been visited. 2. Add ep_get_upwards_depth_proc() for similarly determining the maximum depth of an upwards walk. 3. In ep_loop_check(), use these values to limit the total path length between epoll nodes to EP_MAX_NESTS edges.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-674 Uncontrolled Recursion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38670\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() `cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change to different stacks along with the Shadow Call Stack if it is enabled. Those two stack changes cannot be done atomically and both functions can be interrupted by SErrors or Debug Exceptions which, though unlikely, is very much broken : if interrupted, we can end up with mismatched stacks and Shadow Call Stack leading to clobbered stacks. In `cpu_switch_to()`, it can happen when SP_EL0 points to the new task, but x18 stills points to the old task's SCS. When the interrupt handler tries to save the task's SCS pointer, it will save the old task SCS pointer (x18) into the new task struct (pointed to by SP_EL0), clobbering it. In `call_on_irq_stack()`, it can happen when switching from the task stack to the IRQ stack and when switching back. In both cases, we can be interrupted when the SCS pointer points to the IRQ SCS, but SP points to the task stack. The nested interrupt handler pushes its return addresses on the IRQ SCS. It then detects that SP points to the task stack, calls `call_on_irq_stack()` and clobbers the task SCS pointer with the IRQ SCS pointer, which it will also use ! This leads to tasks returning to addresses on the wrong SCS, or even on the IRQ SCS, triggering kernel panics via CONFIG_VMAP_STACK or FPAC if enabled. This is possible on a default config, but unlikely. However, when enabling CONFIG_ARM64_PSEUDO_NMI, DAIF is unmasked and instead the GIC is responsible for filtering what interrupts the CPU should receive based on priority. Given the goal of emulating NMIs, pseudo-NMIs can be received by the CPU even in `cpu_switch_to()` and `call_on_irq_stack()`, possibly *very* frequently depending on the system configuration and workload, leading to unpredictable kernel panics. Completely mask DAIF in `cpu_switch_to()` and restore it when returning. Do the same in `call_on_irq_stack()`, but restore and mask around the branch. Mask DAIF even if CONFIG_SHADOW_CALL_STACK is not enabled for consistency of behaviour between all configurations. Introduce and use an assembly macro for saving and masking DAIF, as the existing one saves but only masks IF.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38676\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iommu/amd: Avoid stack buffer overflow from kernel cmdline While the kernel command line is considered trusted in most environments, avoid writing 1 byte past the end of \"acpiid\" if the \"str\" argument is maximum length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-805 Buffer Access with Incorrect Length Value\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38677\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-boundary access in dnode page As Jiaming Zhang reported: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x1c1/0x2a0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x17e/0x800 mm/kasan/report.c:480 kasan_report+0x147/0x180 mm/kasan/report.c:593 data_blkaddr fs/f2fs/f2fs.h:3053 [inline] f2fs_data_blkaddr fs/f2fs/f2fs.h:3058 [inline] f2fs_get_dnode_of_data+0x1a09/0x1c40 fs/f2fs/node.c:855 f2fs_reserve_block+0x53/0x310 fs/f2fs/data.c:1195 prepare_write_begin fs/f2fs/data.c:3395 [inline] f2fs_write_begin+0xf39/0x2190 fs/f2fs/data.c:3594 generic_perform_write+0x2c7/0x910 mm/filemap.c:4112 f2fs_buffered_write_iter fs/f2fs/file.c:4988 [inline] f2fs_file_write_iter+0x1ec8/0x2410 fs/f2fs/file.c:5216 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x546/0xa90 fs/read_write.c:686 ksys_write+0x149/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x3d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is in the corrupted image, there is a dnode has the same node id w/ its inode, so during f2fs_get_dnode_of_data(), it tries to access block address in dnode at offset 934, however it parses the dnode as inode node, so that get_dnode_addr() returns 360, then it tries to access page address from 360 + 934 * 4 = 4096 w/ 4 bytes. To fix this issue, let's add sanity check for node id of all direct nodes during f2fs_get_dnode_of_data().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38679\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: Fix OOB read due to missing payload bound check Currently, The event_seq_changed() handler processes a variable number of properties sent by the firmware. The number of properties is indicated by the firmware and used to iterate over the payload. However, the payload size is not being validated against the actual message length. This can lead to out-of-bounds memory access if the firmware provides a property count that exceeds the data available in the payload. Such a condition can result in kernel crashes or potential information leaks if memory beyond the buffer is accessed. Fix this by properly validating the remaining size of the payload before each property access and updating bounds accordingly as properties are parsed. This ensures that property parsing is safely bounded within the received message buffer and protects against malformed or malicious firmware behavior.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38680\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() The buffer length check before calling uvc_parse_format() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 bytes. This can lead to an out-of-bounds read if the buffer has exactly 3 bytes. Fix it by checking that the buffer has at least 4 bytes in uvc_parse_format().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38681\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() Memory hot remove unmaps and tears down various kernel page table regions as required. The ptdump code can race with concurrent modifications of the kernel page tables. When leaf entries are modified concurrently, the dump code may log stale or inconsistent information for a VA range, but this is otherwise not harmful. But when intermediate levels of kernel page table are freed, the dump code will continue to use memory that has been freed and potentially reallocated for another purpose. In such cases, the ptdump code may dereference bogus addresses, leading to a number of potential problems. To avoid the above mentioned race condition, platforms such as arm64, riscv and s390 take memory hotplug lock, while dumping kernel page table via the sysfs interface /sys/kernel/debug/kernel_page_tables. Similar race condition exists while checking for pages that might have been marked W+X via /sys/kernel/debug/kernel_page_tables/check_wx_pages which in turn calls ptdump_check_wx(). Instead of solving this race condition again, let's just move the memory hotplug lock inside generic ptdump_check_wx() which will benefit both the scenarios. Drop get_online_mems() and put_online_mems() combination from all existing platform ptdump code paths.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-366 Race Condition within a Thread\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38683\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, default_device_exit_batch() >> default_device_exit_net() is called. When netvsc NIC is moved back and registered to the default namespace, it automatically brings VF NIC back to the default namespace. This will cause the default_device_exit_net() >> for_each_netdev_safe loop unable to detect the list end, and hit NULL ptr: [ 231.449420] mana 7870:00:00.0 enP30832s1: Moved VF to namespace with: eth0 [ 231.449656] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 231.450246] #PF: supervisor read access in kernel mode [ 231.450579] #PF: error_code(0x0000) - not-present page [ 231.450916] PGD 17b8a8067 P4D 0 [ 231.451163] Oops: Oops: 0000 [#1] SMP NOPTI [ 231.451450] CPU: 82 UID: 0 PID: 1394 Comm: kworker/u768:1 Not tainted 6.16.0-rc4+ #3 VOLUNTARY [ 231.452042] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/21/2024 [ 231.452692] Workqueue: netns cleanup_net [ 231.452947] RIP: 0010:default_device_exit_batch+0x16c/0x3f0 [ 231.453326] Code: c0 0c f5 b3 e8 d5 db fe ff 48 85 c0 74 15 48 c7 c2 f8 fd ca b2 be 10 00 00 00 48 8d 7d c0 e8 7b 77 25 00 49 8b 86 28 01 00 00 <48> 8b 50 10 4c 8b 2a 4c 8d 62 f0 49 83 ed 10 4c 39 e0 0f 84 d6 00 [ 231.454294] RSP: 0018:ff75fc7c9bf9fd00 EFLAGS: 00010246 [ 231.454610] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 61c8864680b583eb [ 231.455094] RDX: ff1fa9f71462d800 RSI: ff75fc7c9bf9fd38 RDI: 0000000030766564 [ 231.455686] RBP: ff75fc7c9bf9fd78 R08: 0000000000000000 R09: 0000000000000000 [ 231.456126] R10: 0000000000000001 R11: 0000000000000004 R12: ff1fa9f70088e340 [ 231.456621] R13: ff1fa9f70088e340 R14: ffffffffb3f50c20 R15: ff1fa9f7103e6340 [ 231.457161] FS: 0000000000000000(0000) GS:ff1faa6783a08000(0000) knlGS:0000000000000000 [ 231.457707] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 231.458031] CR2: 0000000000000010 CR3: 0000000179ab2006 CR4: 0000000000b73ef0 [ 231.458434] Call Trace: [ 231.458600] [ 231.458777] ops_undo_list+0x100/0x220 [ 231.459015] cleanup_net+0x1b8/0x300 [ 231.459285] process_one_work+0x184/0x340 To fix it, move the ns change to a workqueue, and take rtnl_lock to avoid changing the netdev list when default_device_exit_net() is using it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-820 Missing Synchronization\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.2\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38684\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify() after recent changes from Lion [2]. The problem is: in ets_qdisc_change() we purge unused DWRR queues; the value of 'q->nbands' is the new one, and the cleanup should be done with the old one. The problem is here since my first attempts to fix ets_qdisc_change(), but it surfaced again after the recent qdisc len accounting fixes. Fix it purging idle DWRR queues before assigning a new value of 'q->nbands', so that all purge operations find a consistent configuration: - old 'q->nbands' because it's needed by ets_class_find() - old 'q->nstrict' because it's needed by ets_class_is_strict() BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 62 UID: 0 PID: 39457 Comm: tc Kdump: loaded Not tainted 6.12.0-116.el10.x86_64 #1 PREEMPT(voluntary) Hardware name: Dell Inc. PowerEdge R640/06DKY5, BIOS 2.12.2 07/09/2021 RIP: 0010:__list_del_entry_valid_or_report+0x4/0x80 Code: ff 4c 39 c7 0f 84 39 19 8e ff b8 01 00 00 00 c3 cc cc cc cc 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <48> 8b 17 48 8b 4f 08 48 85 d2 0f 84 56 19 8e ff 48 85 c9 0f 84 ab RSP: 0018:ffffba186009f400 EFLAGS: 00010202 RAX: 00000000000000d6 RBX: 0000000000000000 RCX: 0000000000000004 RDX: ffff9f0fa29b69c0 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffffffc12c2400 R08: 0000000000000008 R09: 0000000000000004 R10: ffffffffffffffff R11: 0000000000000004 R12: 0000000000000000 R13: ffff9f0f8cfe0000 R14: 0000000000100005 R15: 0000000000000000 FS: 00007f2154f37480(0000) GS:ffff9f269c1c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001530be001 CR4: 00000000007726f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ets_class_qlen_notify+0x65/0x90 [sch_ets] qdisc_tree_reduce_backlog+0x74/0x110 ets_qdisc_change+0x630/0xa40 [sch_ets] __tc_modify_qdisc.constprop.0+0x216/0x7f0 tc_modify_qdisc+0x7c/0x120 rtnetlink_rcv_msg+0x145/0x3f0 netlink_rcv_skb+0x53/0x100 netlink_unicast+0x245/0x390 netlink_sendmsg+0x21b/0x470 ____sys_sendmsg+0x39d/0x3d0 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xd0 do_syscall_64+0x7d/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f2155114084 Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 25 f0 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 RSP: 002b:00007fff1fd7a988 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000560ec063e5e0 RCX: 00007f2155114084 RDX: 0000000000000000 RSI: 00007fff1fd7a9f0 RDI: 0000000000000003 RBP: 00007fff1fd7aa60 R08: 0000000000000010 R09: 000000000000003f R10: 0000560ee9b3a010 R11: 0000000000000202 R12: 00007fff1fd7aae0 R13: 000000006891ccde R14: 0000560ec063e5e0 R15: 00007fff1fd7aad0 [1] https://lore.kernel.org/netdev/e08c7f4a6882f260011909a868311c6e9b54f3e4.1639153474.git.dcaratti@redhat.com/ [2] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.2\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38685\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible. As part of mapping it has to do resize of console according to frame buffer info. if this resize fails and returns from vc_do_resize() and continues further. At this point console and new frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the screen at later stages where vc_data is related to previous frame buffer and frame buffer info and display vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fast_imageblit(). This bheviour is excepted only when fg_console is equal to requested console which is a visible console and updates screen with invalid struct references in fbcon_putcs().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38687\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the wait_queue_head inside of it. This can cause a use-after-free when the poll entries are later triggered or removed, as the memory for the wait_queue_head has been freed. We need to check there are no tasks queued on any of the subdevices' wait queues before allowing the device to be detached by the `COMEDI_DEVCONFIG` ioctl. Tasks will read-lock `dev->attach_lock` before adding themselves to the subdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl handler by write-locking `dev->attach_lock` before checking that all of the subdevices are safe to be deleted. This includes testing for any sleepers on the subdevices' wait queues. It remains locked until the device has been detached. This requires the `comedi_device_detach()` function to be refactored slightly, moving the bulk of it into new function `comedi_device_detach_locked()`. Note that the refactor of `comedi_device_detach()` results in `comedi_device_cancel_all()` now being called while `dev->attach_lock` is write-locked, which wasn't the case previously, but that does not matter. Thanks to Jens Axboe for diagnosing the problem and co-developing this patch.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38691\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the \"layoutupdate_pages\" page array is initialized only after the retry loop. But ext_tree_free_commitdata() is called on every iteration and tries to put pages in the array, thus dereferencing uninitialized pointers. An additional problem is that there is no limit on the maximum possible buffer_size. When there are too many extents, the client may create a layoutcommit that is larger than the maximum possible RPC size accepted by the server. During testing, we observed two typical scenarios. First, one memory page for extents is enough when we work with small files, append data to the end of the file, or preallocate extents before writing. But when we fill a new large file without preallocating, the number of extents can be huge, and counting the number of written extents in ext_tree_encode_commit() does not help much. Since this number increases even more between unlocking and locking of ext_tree, the reallocated buffer may not be large enough again and again.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-908 Use of Uninitialized Resource\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38693\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar commit: commit 0ed554fd769a (\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38694\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar issue occurs when access msg[1].buf[0] and msg[1].buf[1]. Similar commit: commit 0ed554fd769a (\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38695\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the resultant cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() may occur before sli4_hba.hdwqs are allocated. This may result in a null pointer dereference when attempting to take the abts_io_buf_list_lock for the first hardware queue. Fix by adding a null ptr check on phba->sli4_hba.hdwq and early return because this situation means there must have been an error during port initialization.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38696\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stack_top() for tasks without ABI or vDSO Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL ABI pointer and crash. This can for example happen when using kunit: mips_stack_top+0x28/0xc0 arch_pick_mmap_layout+0x190/0x220 kunit_vm_mmap_init+0xf8/0x138 __kunit_add_resource+0x40/0xa8 kunit_vm_mmap+0x88/0xd8 usercopy_test_init+0xb8/0x240 kunit_try_run_case+0x5c/0x1a8 kunit_generic_run_threadfn_adapter+0x28/0x50 kthread+0x118/0x240 ret_from_kernel_thread+0x14/0x1c Only dereference the ABI point if it is set. The GIC page is also included as it is specific to the vDSO. Also move the randomization adjustment into the same conditional.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38697\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: upper bound check of tree index in dbAllocAG When computing the tree index in dbAllocAG, we never check if we are out of bounds realative to the size of the stree. This could happen in a scenario where the filesystem metadata are corrupted.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38698\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: Regular file corruption check The reproducer builds a corrupted file on disk with a negative i_size value. Add a check when opening this file to avoid subsequent operation failures.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38699\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix When the bfad_im_probe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfad->im to NULL. Subsequently, during driver uninstallation, when the state machine enters the bfad_sm_stopping state and calls the bfad_im_probe_undo() function, it attempts to free the memory pointed to by bfad->im again, thereby triggering a double-free vulnerability. Set bfad->im to NULL if probing fails.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-415 Double Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.4\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38700\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated In case of an ib_fast_reg_mr allocation failure during iSER setup, the machine hits a panic because iscsi_conn->dd_data is initialized unconditionally, even when no memory is allocated (dd_size == 0). This leads invalid pointer dereference during connection teardown. Fix by setting iscsi_conn->dd_data only if memory is actually allocated. Panic trace: ------------ iser: iser_create_fastreg_desc: Failed to allocate ib_fast_reg_mr err=-12 iser: iser_alloc_rx_descriptors: failed allocating rx descriptors / data buffers BUG: unable to handle page fault for address: fffffffffffffff8 RIP: 0010:swake_up_locked.part.5+0xa/0x40 Call Trace: complete+0x31/0x40 iscsi_iser_conn_stop+0x88/0xb0 [ib_iser] iscsi_stop_conn+0x66/0xc0 [scsi_transport_iscsi] iscsi_if_stop_conn+0x14a/0x150 [scsi_transport_iscsi] iscsi_if_rx+0x1135/0x1834 [scsi_transport_iscsi] ? netlink_lookup+0x12f/0x1b0 ? netlink_deliver_tap+0x2c/0x200 netlink_unicast+0x1ab/0x280 netlink_sendmsg+0x257/0x4f0 ? _copy_from_user+0x29/0x60 sock_sendmsg+0x5f/0x70\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38701\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missing the system.data extended attribute. Since this can happen due to a maiciouly fuzzed file system, we shouldn't BUG, but rather, report it as a corrupted file system. Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii ext4_create_inline_data() and ext4_inline_data_truncate().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-617 Reachable Assertion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38702\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer overflow in do_register_framebuffer() The current implementation may lead to buffer overflow when: 1. Unregistration creates NULL gaps in registered_fb[] 2. All array slots become occupied despite num_registered_fb < FB_MAX 3. The registration loop exceeds array bounds Add boundary check to prevent registered_fb[FB_MAX] access.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38706\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on the system. On module removal the soc_tplg_remove_link() would call snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored, no runtime was created.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38707\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for file name The length of the file name should be smaller than the directory entry size.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38708\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD tries to detect \"concurrent\" writes and handle write conflicts, so that even if you write to the same sector simultaneously on both nodes, they end up with the identical data once the writes are completed. In handling \"superseeded\" writes, we forgot a kref_get, resulting in a premature drbd_destroy_device and use after free, and further to kernel crashes with symptoms. Relevance: No one should use DRBD as a random data generator, and apparently all users of \"two-primaries\" handle concurrent writes correctly on layer up. That is cluster file systems use some distributed lock manager, and live migration in virtualization environments stops writes on one node before starting writes on the other node. Which means that other than for \"test cases\", this code path is never taken in real life. FYI, in DRBD 9, things are handled differently nowadays. We still detect \"write conflicts\", but no longer try to be smart about them. We decided to disconnect hard instead: upper layers must not submit concurrent writes. If they do, that's their fault.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38711\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb/server: avoid deadlock when linking with ReplaceIfExists If smb2_create_link() is called with ReplaceIfExists set and the name does exist then a deadlock will happen. ksmbd_vfs_kern_path_locked() will return with success and the parent directory will be locked. ksmbd_vfs_remove_file() will then remove the file. ksmbd_vfs_link() will then be called while the parent is still locked. It will try to lock the same parent and will deadlock. This patch moves the ksmbd_vfs_kern_path_unlock() call to *before* ksmbd_vfs_link() and then simplifies the code, removing the file_present flag variable.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38712\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplus_fill_super() assumes that the attributes file is not yet created, which later results in hitting BUG_ON() when hfsplus_create_attributes_file() is called. Replace this BUG_ON() with -EIO error with a message to suggest running fsck tool.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38713\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc(): [ 667.121659][ T9805] ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][ T9805] [ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0 [ 667.124911][ T9805] print_report+0xd0/0x660 [ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610 [ 667.124928][ T9805] ? __phys_addr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124942][ T9805] kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][ T9805] hfsplus_uni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360 [ 667.124974][ T9805] hfsplus_readdir+0x845/0xfc0 [ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10 [ 667.124994][ T9805] ? stack_trace_save+0x8e/0xc0 [ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125015][ T9805] ? trace_lock_acquire+0x85/0xd0 [ 667.125022][ T9805] ? lock_acquire+0x30/0x80 [ 667.125029][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10 [ 667.125058][ T9805] ? apparmor_file_permission+0x239/0x3e0 [ 667.125069][ T9805] iterate_dir+0x296/0xb20 [ 667.125076][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10 [ 667.125091][ T9805] ? __x64_sys_openat+0x141/0x200 [ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10 [ 667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0 [ 667.125143][ T9805] do_syscall_64+0xc9/0x480 [ 667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] [ 667.125210][ T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasan_save_stack+0x20/0x40 [ 667.146352][ T9805] kasan_save_track+0x14/0x30 [ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0 [ 667.147065][ T9805] __kmalloc_noprof+0x205/0x550 [ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0 [ 667.147813][ T9805] hfsplus_readdir+0x220/0xfc0 [ 667.148174][ T9805] iterate_dir+0x296/0xb20 [ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805] do_syscall_64+0xc9/0x480 [ 667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.1 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38714\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() The hfsplus_bnode_read() method can trigger the issue: [ 174.852007][ T9784] ================================================================== [ 174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360 [ 174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784 [ 174.854059][ T9784] [ 174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full) [ 174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.854286][ T9784] Call Trace: [ 174.854289][ T9784] [ 174.854292][ T9784] dump_stack_lvl+0x10e/0x1f0 [ 174.854305][ T9784] print_report+0xd0/0x660 [ 174.854315][ T9784] ? __virt_addr_valid+0x81/0x610 [ 174.854323][ T9784] ? __phys_addr+0xe8/0x180 [ 174.854330][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854337][ T9784] kasan_report+0xc6/0x100 [ 174.854346][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854354][ T9784] hfsplus_bnode_read+0x2f4/0x360 [ 174.854362][ T9784] hfsplus_bnode_dump+0x2ec/0x380 [ 174.854370][ T9784] ? __pfx_hfsplus_bnode_dump+0x10/0x10 [ 174.854377][ T9784] ? hfsplus_bnode_write_u16+0x83/0xb0 [ 174.854385][ T9784] ? srcu_gp_start+0xd0/0x310 [ 174.854393][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854402][ T9784] hfsplus_brec_remove+0x3d2/0x4e0 [ 174.854411][ T9784] __hfsplus_delete_attr+0x290/0x3a0 [ 174.854419][ T9784] ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10 [ 174.854427][ T9784] ? __pfx___hfsplus_delete_attr+0x10/0x10 [ 174.854436][ T9784] ? __asan_memset+0x23/0x50 [ 174.854450][ T9784] hfsplus_delete_all_attrs+0x262/0x320 [ 174.854459][ T9784] ? __pfx_hfsplus_delete_all_attrs+0x10/0x10 [ 174.854469][ T9784] ? rcu_is_watching+0x12/0xc0 [ 174.854476][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854483][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.854493][ T9784] ? __pfx_hfsplus_delete_cat+0x10/0x10 [ 174.854507][ T9784] hfsplus_unlink+0x1ca/0x7c0 [ 174.854516][ T9784] ? __pfx_hfsplus_unlink+0x10/0x10 [ 174.854525][ T9784] ? down_write+0x148/0x200 [ 174.854532][ T9784] ? __pfx_down_write+0x10/0x10 [ 174.854540][ T9784] vfs_unlink+0x2fe/0x9b0 [ 174.854549][ T9784] do_unlinkat+0x490/0x670 [ 174.854557][ T9784] ? __pfx_do_unlinkat+0x10/0x10 [ 174.854565][ T9784] ? __might_fault+0xbc/0x130 [ 174.854576][ T9784] ? getname_flags.part.0+0x1c5/0x550 [ 174.854584][ T9784] __x64_sys_unlink+0xc5/0x110 [ 174.854592][ T9784] do_syscall_64+0xc9/0x480 [ 174.854600][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167 [ 174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08 [ 174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167 [ 174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50 [ 174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40 [ 174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0 [ 174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 174.854658][ T9784] [ 174.854661][ T9784] [ 174.879281][ T9784] Allocated by task 9784: [ 174.879664][ T9784] kasan_save_stack+0x20/0x40 [ 174.880082][ T9784] kasan_save_track+0x14/0x30 [ 174.880500][ T9784] __kasan_kmalloc+0xaa/0xb0 [ 174.880908][ T9784] __kmalloc_noprof+0x205/0x550 [ 174.881337][ T9784] __hfs_bnode_create+0x107/0x890 [ 174.881779][ T9784] hfsplus_bnode_find+0x2d0/0xd10 [ 174.882222][ T9784] hfsplus_brec_find+0x2b0/0x520 [ 174.882659][ T9784] hfsplus_delete_all_attrs+0x23b/0x3 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38715\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfs: fix slab-out-of-bounds in hfs_bnode_read() This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(), hfs_bnode_copy(), and hfs_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38721\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone. This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0. This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever. This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list. One fix would to change this to: if (res < 0) { if (ct != last) nf_conntrack_get(&ct->ct_general); But this reference counting isn't needed in the first place. We can just store a cookie value instead. A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-772 Missing Release of Resource after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38723\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix jump offset calculation in tailcall The extra pass of bpf_int_jit_compile() skips JIT context initialization which essentially skips offset calculation leaving out_offset = -1, so the jmp_offset in emit_bpf_tail_call is calculated by \"#define jmp_offset (out_offset - (cur_offset))\" is a negative number, which is wrong. The final generated assembly are as follow. 54: bgeu $a2, $t1, -8 # 0x0000004c 58: addi.d $a6, $s5, -1 5c: bltz $a6, -16 # 0x0000004c 60: alsl.d $t2, $a2, $a1, 0x3 64: ld.d $t2, $t2, 264 68: beq $t2, $zero, -28 # 0x0000004c Before apply this patch, the follow test case will reveal soft lock issues. cd tools/testing/selftests/bpf/ ./test_progs --allow=tailcalls/tailcall_bpf2bpf_1 dmesg: watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [test_progs:25056]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38724\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38725\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: add phy_mask for ax88772 mdio bus Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00 ~ 0x1f. DLink DUB-E100 H/W Ver B1 is such a device. However, only one main phy device will bind to net phy driver. This is creating issue during system suspend/resume since phy_polling_mode() in phy_state_machine() will directly deference member of phydev->drv for non-main phy devices. Then NULL pointer dereference issue will occur. Due to only external phy or internal phy is necessary, add phy_mask for ax88772 mdio bus to workarnoud the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38727\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has: rmem < READ_ONCE(sk->sk_rcvbuf) to check if the just increased rmem value fits into the socket's receive buffer. If not, it proceeds and tries to wait for the memory under: rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf) The checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is equal to sk->sk_rcvbuf. Thus the function neither successfully accepts these conditions, nor manages to reschedule the task - and is called in retry loop for indefinite time which is caught as: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 0-....: (25999 ticks this GP) idle=ef2/1/0x4000000000000000 softirq=262269/262269 fqs=6212 (t=26000 jiffies g=230833 q=259957) NMI backtrace for cpu 0 CPU: 0 PID: 22 Comm: kauditd Not tainted 5.10.240 #68 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc42 04/01/2014 Call Trace: dump_stack lib/dump_stack.c:120 nmi_cpu_backtrace.cold lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace lib/nmi_backtrace.c:62 rcu_dump_cpu_stacks kernel/rcu/tree_stall.h:335 rcu_sched_clock_irq.cold kernel/rcu/tree.c:2590 update_process_times kernel/time/timer.c:1953 tick_sched_handle kernel/time/tick-sched.c:227 tick_sched_timer kernel/time/tick-sched.c:1399 __hrtimer_run_queues kernel/time/hrtimer.c:1652 hrtimer_interrupt kernel/time/hrtimer.c:1717 __sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1113 asm_call_irq_on_stack arch/x86/entry/entry_64.S:808 netlink_attachskb net/netlink/af_netlink.c:1234 netlink_unicast net/netlink/af_netlink.c:1349 kauditd_send_queue kernel/audit.c:776 kauditd_thread kernel/audit.c:897 kthread kernel/kthread.c:328 ret_from_fork arch/x86/entry/entry_64.S:304 Restore the original behavior of the check which commit in Fixes accidentally missed when restructuring the code. Found by Linux Verification Center (linuxtesting.org).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38728\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below): BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827 CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38729\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38732\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't leak dst refcount for loopback packets recent patches to add a WARN() when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 [..] Call Trace: nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] .. This is because blamed commit forgot about loopback packets. Such packets already have a dst_entry attached, even at PRE_ROUTING stage. Instead of checking hook just check if the skb already has a route attached to it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-911 Improper Update of Reference Count\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.8\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38735\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: gve: prevent ethtool ops after shutdown A crash can occur if an ethtool operation is invoked after shutdown() is called. shutdown() is invoked during system shutdown to stop DMA operations without performing expensive deallocations. It is discouraged to unregister the netdev in this path, so the device may still be visible to userspace and kernel helpers. In gve, shutdown() tears down most internal data structures. If an ethtool operation is dispatched after shutdown(), it will dereference freed or NULL pointers, leading to a kernel panic. While graceful shutdown normally quiesces userspace before invoking the reboot syscall, forced shutdowns (as observed on GCP VMs) can still trigger this path. Fix by calling netif_device_detach() in shutdown(). This marks the device as detached so the ethtool ioctl handler will skip dispatching operations to the driver.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-664 Improper Control of a Resource Through its Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38736\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization Syzbot reported shift-out-of-bounds exception on MDIO bus initialization. The PHY address should be masked to 5 bits (0-31). Without this mask, invalid PHY addresses could be used, potentially causing issues with MDIO bus operations. Fix this by masking the PHY address with 0x1f (31 decimal) to ensure it stays within the valid range.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39673\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic. 2. pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels. Fix these by using a lockless RCU approach: - Use list_first_or_null_rcu() to safely test and access the first list entry. - Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal. - Check for a NULL pch->chan before dereferencing it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39675\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() The function mod_hdcp_hdcp1_create_session() calls the function get_first_active_display(), but does not check its return value. The return value is a null pointer if the display list is empty. This will lead to a null pointer dereference. Add a null pointer check for get_first_active_display() and return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND if the function return null. This is similar to the commit c3e9826a2202 (\"drm/amd/display: Add null pointer check for get_first_active_display()\"). (cherry picked from commit 5e43eb3cd731649c4f8b9134f857be62a416c893)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39676\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Prevent a potential error pointer dereference The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-394 Unexpected Status Code or Return Value\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.1\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39681\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd (\"x86/resctrl: Query LLC monitoring properties once during boot\") resctrl_cpu_detect() has been moved from common CPU initialization code to the vendor-specific BSP init helper, while Hygon didn't put that call in their code. This triggers a division by zero fault during early booting stage on our machines with X86_FEATURE_CQM* supported, where get_rdt_mon_resources() tries to calculate mon_l3_config with uninitialized boot_cpu_data.x86_cache_occ_scale. Add the missing resctrl_cpu_detect() in the Hygon BSP init helper. [ bp: Massage commit message. ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-369 Divide By Zero\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39682\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39683\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser->buffer when trace_get_user failed When the length of the string written to set_ftrace_filter exceeds FTRACE_BUFF_MAX, the following KASAN alarm will be triggered: BUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0 Read of size 1 at addr ffff0000d00bd5ba by task ash/165 CPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x34/0x50 (C) dump_stack_lvl+0xa0/0x158 print_address_description.constprop.0+0x88/0x398 print_report+0xb0/0x280 kasan_report+0xa4/0xf0 __asan_report_load1_noabort+0x20/0x30 strsep+0x18c/0x1b0 ftrace_process_regex.isra.0+0x100/0x2d8 ftrace_regex_release+0x484/0x618 __fput+0x364/0xa58 ____fput+0x28/0x40 task_work_run+0x154/0x278 do_notify_resume+0x1f0/0x220 el0_svc+0xec/0xf0 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1ac/0x1b0 The reason is that trace_get_user will fail when processing a string longer than FTRACE_BUFF_MAX, but not set the end of parser->buffer to 0. Then an OOB access will be triggered in ftrace_regex_release-> ftrace_process_regex->strsep->strpbrk. We can solve this problem by limiting access to parser->buffer when trace_get_user failed.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39684\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() syzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`. A kernel buffer is allocated to hold `insn->n` samples (each of which is an `unsigned int`). For some instruction types, `insn->n` samples are copied back to user-space, unless an error code is being returned. The problem is that not all the instruction handlers that need to return data to userspace fill in the whole `insn->n` samples, so that there is an information leak. There is a similar syzbot report for `do_insnlist_ioctl()`, although it does not have a reproducer for it at the time of writing. One culprit is `insn_rw_emulate_bits()` which is used as the handler for `INSN_READ` or `INSN_WRITE` instructions for subdevices that do not have a specific handler for that instruction, but do have an `INSN_BITS` handler. For `INSN_READ` it only fills in at most 1 sample, so if `insn->n` is greater than 1, the remaining `insn->n - 1` samples copied to userspace will be uninitialized kernel data. Another culprit is `vm80xx_ai_insn_read()` in the \"vm80xx\" driver. It never returns an error, even if it fails to fill the buffer. Fix it in `do_insn_ioctl()` and `do_insnlist_ioctl()` by making sure that uninitialized parts of the allocated buffer are zeroed before handling each instruction. Thanks to Arnaud Lecomte for their fix to `do_insn_ioctl()`. That fix replaced the call to `kmalloc_array()` with `kcalloc()`, but it is not always necessary to clear the whole buffer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39685\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: pcl726: Prevent invalid irq number The reproducer passed in an irq number(0x80008000) that was too large, which triggered the oob. Added an interrupt number check to prevent users from passing in an irq number that was too large. If `it->options[1]` is 31, then `1 << it->options[1]` is still invalid because it shifts a 1-bit into the sign bit (which is UB in C). Possible solutions include reducing the upper bound on the `it->options[1]` value to 30 or lower, or using `1U << it->options[1]`. The old code would just not attempt to request the IRQ if the `options[1]` value were invalid. And it would still configure the device without interrupts even if the call to `request_irq` returned an error. So it would be better to combine this test with the test below.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39686\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: Make insn_rw_emulate_bits() do insn->n samples The `insn_rw_emulate_bits()` function is used as a default handler for `INSN_READ` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_READ`. Similarly, it is used as a default handler for `INSN_WRITE` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_WRITE`. It works by emulating the `INSN_READ` or `INSN_WRITE` instruction handling with a constructed `INSN_BITS` instruction. However, `INSN_READ` and `INSN_WRITE` instructions are supposed to be able read or write multiple samples, indicated by the `insn->n` value, but `insn_rw_emulate_bits()` currently only handles a single sample. For `INSN_READ`, the comedi core will copy `insn->n` samples back to user-space. (That triggered KASAN kernel-infoleak errors when `insn->n` was greater than 1, but that is being fixed more generally elsewhere in the comedi core.) Make `insn_rw_emulate_bits()` either handle `insn->n` samples, or return an error, to conform to the general expectation for `INSN_READ` and `INSN_WRITE` handlers.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39687\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: light: as73211: Ensure buffer holes are zeroed Given that the buffer is copied to a kfifo that ultimately user space can read, ensure we zero it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39689\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the reader keeps the pointer to the filter hashes. This is problematic because this pointer is static across function calls that release the locks that can update the global tracer hashes. This can cause UAF and similar bugs. Allocate and copy the hash for reading the filter files like it is done for the writers. This not only fixes UAF bugs, but also makes the code a bit simpler as it doesn't have to differentiate when to free the iterator's hash between writers and readers.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39691\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.16.0-862.14.0.6.x86_64 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: dump_stack_lvl+0x55/0x70 print_address_description.constprop.0+0x2c/0x390 print_report+0xb4/0x270 kasan_report+0xb8/0xf0 end_buffer_read_sync+0xe3/0x110 end_bio_bh_io_sync+0x56/0x80 blk_update_request+0x30a/0x720 scsi_end_request+0x51/0x2b0 scsi_io_completion+0xe3/0x480 ? scsi_device_unbusy+0x11e/0x160 blk_complete_reqs+0x7b/0x90 handle_softirqs+0xef/0x370 irq_exit_rcu+0xa5/0xd0 sysvec_apic_timer_interrupt+0x6e/0x90 Above issue happens when do ntfs3 filesystem mount, issue may happens as follows: mount IRQ ntfs_fill_super read_cache_page do_read_cache_folio filemap_read_folio mpage_read_folio do_mpage_readpage ntfs_get_block_vbo bh_read submit_bh wait_on_buffer(bh); blk_complete_reqs scsi_io_completion scsi_end_request blk_update_request end_bio_bh_io_sync end_buffer_read_sync __end_buffer_read_notouch unlock_buffer wait_on_buffer(bh);--> return will return to caller put_bh --> trigger stack-out-of-bounds In the mpage_read_folio() function, the stack variable 'map_bh' is passed to ntfs_get_block_vbo(). Once unlock_buffer() unlocks and wait_on_buffer() returns to continue processing, the stack variable is likely to be reclaimed. Consequently, during the end_buffer_read_sync() process, calling put_bh() may result in stack overrun. If the bh is not allocated on the stack, it belongs to a folio. Freeing a buffer head which belongs to a folio is done by drop_buffers() which will fail to free buffers which are still locked. So it is safe to call put_bh() before __end_buffer_read_notouch().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39692\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() We can't call destroy_workqueue(smb_direct_wq); before stop_sessions()! Otherwise already existing connections try to use smb_direct_wq as a NULL pointer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39693\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid a NULL pointer dereference [WHY] Although unlikely drm_atomic_get_new_connector_state() or drm_atomic_get_old_connector_state() can return NULL. [HOW] Check returns before dereference. (cherry picked from commit 1e5e8d672fec9f2ab352be121be971877bff2af9)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39694\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrupt is NULL. This check is performed after physical to virtual address translation. If the kernel identity mapping does not start at address zero, the resulting virtual address is never zero, so that the NULL checks won't work. Subsequently this may result in incorrect accesses to the first page of the identity mapping. Fix this by introducing a function that handles the NULL case before address translation.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39697\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_request() from succeeding until we actually lock the page group. The reason is that whoever called nfs_inode_remove_request() doesn't necessarily have a lock on the page group head. So in order to avoid races, let's take the page group lock earlier in nfs_lock_and_join_requests(), and hold it across the removal of the request in nfs_inode_remove_request().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39701\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: Fix the driver update version check The security-version-number check should be used rather than the runtime version check for driver updates. Otherwise, the firmware update would fail when the update binary had a lower runtime version number than the current one. [ rjw: Changelog edits ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1025 Comparison Using Wrong Factors\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39702\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-208 Observable Timing Discrepancy\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39703\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net, hsr: reject HSR frame if skb can't hold tag Receiving HSR frame with insufficient space to hold HSR tag in the skb can result in a crash (kernel BUG): [ 45.390915] skbuff: skb_under_panic: text:ffffffff86f32cac len:26 put:14 head:ffff888042418000 data:ffff888042417ff4 tail:0xe end:0x180 dev:bridge_slave_1 [ 45.392559] ------------[ cut here ]------------ [ 45.392912] kernel BUG at net/core/skbuff.c:211! [ 45.393276] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 45.393809] CPU: 1 UID: 0 PID: 2496 Comm: reproducer Not tainted 6.15.0 #12 PREEMPT(undef) [ 45.394433] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 45.395273] RIP: 0010:skb_panic+0x15b/0x1d0 [ 45.402911] Call Trace: [ 45.403105] [ 45.404470] skb_push+0xcd/0xf0 [ 45.404726] br_dev_queue_push_xmit+0x7c/0x6c0 [ 45.406513] br_forward_finish+0x128/0x260 [ 45.408483] __br_forward+0x42d/0x590 [ 45.409464] maybe_deliver+0x2eb/0x420 [ 45.409763] br_flood+0x174/0x4a0 [ 45.410030] br_handle_frame_finish+0xc7c/0x1bc0 [ 45.411618] br_handle_frame+0xac3/0x1230 [ 45.413674] __netif_receive_skb_core.constprop.0+0x808/0x3df0 [ 45.422966] __netif_receive_skb_one_core+0xb4/0x1f0 [ 45.424478] __netif_receive_skb+0x22/0x170 [ 45.424806] process_backlog+0x242/0x6d0 [ 45.425116] __napi_poll+0xbb/0x630 [ 45.425394] net_rx_action+0x4d1/0xcc0 [ 45.427613] handle_softirqs+0x1a4/0x580 [ 45.427926] do_softirq+0x74/0x90 [ 45.428196] This issue was found by syzkaller. The panic happens in br_dev_queue_push_xmit() once it receives a corrupted skb with ETH header already pushed in linear data. When it attempts the skb_push() call, there's not enough headroom and skb_push() panics. The corrupted skb is put on the queue by HSR layer, which makes a sequence of unintended transformations when it receives a specific corrupted HSR frame (with incomplete TAG). Fix it by dropping and consuming frames that are not long enough to contain both ethernet and hsr headers. Alternative fix would be to check for enough headroom before skb_push() in br_dev_queue_push_xmit(). In the reproducer, this is injected via AF_PACKET, but I don't easily see why it couldn't be sent over the wire from adjacent network. Further Details: In the reproducer, the following network interface chain is set up: \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 veth0_to_hsr \u251c\u2500\u2500\u2500\u2524 hsr_slave0 \u253c\u2500\u2500\u2500\u2510 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u251c\u2500\u2524 hsr0 \u251c\u2500\u2500\u2500\u2510 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 \u2502\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 veth1_to_hsr \u253c\u2500\u2500\u2500\u2524 hsr_slave1 \u251c\u2500\u2500\u2500\u2518 \u2514\u2524 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u250c\u253c bridge \u2502 \u2502\u2502 \u2502 \u2502\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 \u2502 ... \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 To trigger the events leading up to crash, reproducer sends a corrupted HSR fr ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1286 Improper Validation of Syntactic Correctness of Input\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39706\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq Since KFD proc content was moved to kernel debugfs, we can't destroy KFD debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line debugfs_remove_recursive(entry->proc_dentry); tries to remove /sys/kernel/debug/kfd/proc/ while /sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel NULL pointer. (cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39709\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: protect against spurious interrupts during probe Make sure the interrupt handler is initialized before the interrupt is registered. If the IRQ is registered before hfi_create(), it's possible that an interrupt fires before the handler setup is complete, leading to a NULL dereference. This error condition has been observed during system boot on Rb3Gen2.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39710\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: Add a check for packet size after reading from shared memory Add a check to ensure that the packet size does not exceed the number of available words after reading the packet header from shared memory. This ensures that the size provided by the firmware is safe to process and prevent potential out-of-bounds memory access.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39713\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() In the interrupt handler rain_interrupt(), the buffer full check on rain->buf_len is performed before acquiring rain->buf_lock. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as rain->buf_len is concurrently accessed and modified in the work handler rain_irq_work_handler() under the same lock. Multiple interrupt invocations can race, with each reading buf_len before it becomes full and then proceeding. This can lead to both interrupts attempting to write to the buffer, incrementing buf_len beyond its capacity (DATA_SIZE) and causing a buffer overflow. Fix this bug by moving the spin_lock() to before the buffer full check. This ensures that the check and the subsequent buffer modification are performed atomically, preventing the race condition. An corresponding spin_unlock() is added to the overflow path to correctly release the lock. This possible bug was found by an experimental static analysis tool developed by our team.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39714\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: usbtv: Lock resolution while streaming When an program is streaming (ffplay) and another program (qv4l2) changes the TV standard from NTSC to PAL, the kernel crashes due to trying to copy to unmapped memory. Changing from NTSC to PAL increases the resolution in the usbtv struct, but the video plane buffer isn't adjusted, so it overflows. [hverkuil: call vb2_is_busy instead of vb2_is_streaming]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39715\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: parisc: Revise gateway LWS calls to probe user read access We use load and stbys,e instructions to trigger memory reference interruptions without writing to memory. Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel and gateway page execute at privilege level 0, so this code never triggers a read access interruption. Thus, it is currently possible for user code to execute a LWS compare and swap operation at an address that is read protected at privilege level 3 (PRIV_USER). Fix this by probing read access rights at privilege level 3 and branching to lws_fault if access isn't allowed.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39716\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: parisc: Revise __get_user() to probe user read access Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel executes at privilege level 0, so __get_user() never triggers a read access interruption (code 26). Thus, it is currently possible for user code to access a read protected address via a system call. Fix this by probing read access rights at privilege level 3 (PRIV_USER) and setting __gu_err to -EFAULT (-14) if access isn't allowed. Note the cmpiclr instruction does a 32-bit compare because COND macro doesn't work inside asm.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39718\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately, virtio_vsock_skb_rx_put() uses the length from the packet header as the length argument to skb_put(), potentially resulting in SKB overflow if the host has gone wonky. Validate the length as advertised by the packet header before calling virtio_vsock_skb_rx_put().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.6\nHIGH\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39719\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: imu: bno055: fix OOB access of hw_xlate array Fix a potential out-of-bounds array access of the hw_xlate array in bno055.c. In bno055_get_regmask(), hw_xlate was iterated over the length of the vals array instead of the length of the hw_xlate array. In the case of bno055_gyr_scale, the vals array is larger than the hw_xlate array, so this could result in an out-of-bounds access. In practice, this shouldn't happen though because a match should always be found which breaks out of the for loop before it iterates beyond the end of the hw_xlate array. By adding a new hw_xlate_len field to the bno055_sysfs_attr, we can be sure we are iterating over the correct length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39724\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix panic due to PSLVERR When the PSLVERR_RESP_EN parameter is set to 1, the device generates an error response if an attempt is made to read an empty RBR (Receive Buffer Register) while the FIFO is enabled. In serial8250_do_startup(), calling serial_port_out(port, UART_LCR, UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes dw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter function enables the FIFO via serial_out(p, UART_FCR, p->fcr). Execution proceeds to the serial_port_in(port, UART_RX). This satisfies the PSLVERR trigger condition. When another CPU (e.g., using printk()) is accessing the UART (UART is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter dw8250_force_idle(). Put serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock to fix this issue. Panic backtrace: [ 0.442336] Oops - unknown exception [#1] [ 0.442343] epc : dw8250_serial_in32+0x1e/0x4a [ 0.442351] ra : serial8250_do_startup+0x2c8/0x88e ... [ 0.442416] console_on_rootfs+0x26/0x70\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39736\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() can cause a deadlock due to lock inversion with the netconsole subsystem. This occurs because pr_warn_once() may trigger netpoll, which eventually leads to __alloc_skb() and back into kmemleak code, attempting to reacquire kmemleak_lock. This is the path for the deadlock. mem_pool_alloc() -> raw_spin_lock_irqsave(&kmemleak_lock, flags); -> pr_warn_once() -> netconsole subsystem -> netpoll -> __alloc_skb -> __create_object -> raw_spin_lock_irqsave(&kmemleak_lock, flags); Fix this by setting a flag and issuing the pr_warn_once() after kmemleak_lock is released.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-833 Deadlock\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39737\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() A soft lockup warning was observed on a relative small system x86-64 system with 16 GB of memory when running a debug kernel with kmemleak enabled. watchdog: BUG: soft lockup - CPU#8 stuck for 33s! [kworker/8:1:134] The test system was running a workload with hot unplug happening in parallel. Then kemleak decided to disable itself due to its inability to allocate more kmemleak objects. The debug kernel has its CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE set to 40,000. The soft lockup happened in kmemleak_do_cleanup() when the existing kmemleak objects were being removed and deleted one-by-one in a loop via a workqueue. In this particular case, there are at least 40,000 objects that need to be processed and given the slowness of a debug kernel and the fact that a raw_spinlock has to be acquired and released in __delete_object(), it could take a while to properly handle all these objects. As kmemleak has been disabled in this case, the object removal and deletion process can be further optimized as locking isn't really needed. However, it is probably not worth the effort to optimize for such an edge case that should rarely happen. So the simple solution is to call cond_resched() at periodic interval in the iteration loop to avoid soft lockup.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39738\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: do not allow relocation of partially dropped subvolumes [BUG] There is an internal report that balance triggered transaction abort, with the following call trace: item 85 key (594509824 169 0) itemoff 12599 itemsize 33 extent refs 1 gen 197740 flags 2 ref#0: tree block backref root 7 item 86 key (594558976 169 0) itemoff 12566 itemsize 33 extent refs 1 gen 197522 flags 2 ref#0: tree block backref root 7 ... BTRFS error (device loop0): extent item not found for insert, bytenr 594526208 num_bytes 16384 parent 449921024 root_objectid 934 owner 1 offset 0 BTRFS error (device loop0): failed to run delayed ref for logical 594526208 num_bytes 16384 type 182 action 1 ref_mod 1: -117 ------------[ cut here ]------------ BTRFS: Transaction aborted (error -117) WARNING: CPU: 1 PID: 6963 at ../fs/btrfs/extent-tree.c:2168 btrfs_run_delayed_refs+0xfa/0x110 [btrfs] And btrfs check doesn't report anything wrong related to the extent tree. [CAUSE] The cause is a little complex, firstly the extent tree indeed doesn't have the backref for 594526208. The extent tree only have the following two backrefs around that bytenr on-disk: item 65 key (594509824 METADATA_ITEM 0) itemoff 13880 itemsize 33 refs 1 gen 197740 flags TREE_BLOCK tree block skinny level 0 (176 0x7) tree block backref root CSUM_TREE item 66 key (594558976 METADATA_ITEM 0) itemoff 13847 itemsize 33 refs 1 gen 197522 flags TREE_BLOCK tree block skinny level 0 (176 0x7) tree block backref root CSUM_TREE But the such missing backref item is not an corruption on disk, as the offending delayed ref belongs to subvolume 934, and that subvolume is being dropped: item 0 key (934 ROOT_ITEM 198229) itemoff 15844 itemsize 439 generation 198229 root_dirid 256 bytenr 10741039104 byte_limit 0 bytes_used 345571328 last_snapshot 198229 flags 0x1000000000001(RDONLY) refs 0 drop_progress key (206324 EXTENT_DATA 2711650304) drop_level 2 level 2 generation_v2 198229 And that offending tree block 594526208 is inside the dropped range of that subvolume. That explains why there is no backref item for that bytenr and why btrfs check is not reporting anything wrong. But this also shows another problem, as btrfs will do all the orphan subvolume cleanup at a read-write mount. So half-dropped subvolume should not exist after an RW mount, and balance itself is also exclusive to subvolume cleanup, meaning we shouldn't hit a subvolume half-dropped during relocation. The root cause is, there is no orphan item for this subvolume. In fact there are 5 subvolumes from around 2021 that have the same problem. It looks like the original report has some older kernels running, and caused those zombie subvolumes. Thankfully upstream commit 8d488a8c7ba2 (\"btrfs: fix subvolume/snapshot deletion not triggered on mount\") has long fixed the bug. [ENHANCEMENT] For repairing such old fs, btrfs-progs will be enhanced. Considering how delayed the problem will show up (at run delayed ref time) and at that time we have to abort transaction already, it is too late. Instead here we reject any half-dropped subvolume for reloc tree at the earliest time, preventing confusion and extra time wasted on debugging similar bugs.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39742\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() The function divides number of online CPUs by num_core_siblings, and later checks the divider by zero. This implies a possibility to get and divide-by-zero runtime error. Fix it by moving the check prior to division. This also helps to save one indentation level.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100&lt;/div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-369 Divide By Zero\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39743\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: truncate good inode pages when hard link is 0 The fileset value of the inode copy from the disk by the reproducer is AGGR_RESERVED_I. When executing evict, its hard link number is 0, so its inode pages are not truncated. This causes the bugon to be triggered when executing clear_inode() because nrpages is greater than 0.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39749\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: rcu: Protect ->defer_qs_iw_pending from data race On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke rcu_read_unlock_special(), which uses an irq-work handler to force the system to notice when the RCU read-side critical section actually ends. That end won't happen until interrupts are enabled at the soonest. In some kernels, such as those booted with rcutree.use_softirq=y, the irq-work handler is used unconditionally. The per-CPU rcu_data structure's ->defer_qs_iw_pending field is updated by the irq-work handler and is both read and updated by rcu_read_unlock_special(). This resulted in the following KCSAN splat: ------------------------------------------------------------------------ BUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special read to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8: rcu_read_unlock_special+0x175/0x260 __rcu_read_unlock+0x92/0xa0 rt_spin_unlock+0x9b/0xc0 __local_bh_enable+0x10d/0x170 __local_bh_enable_ip+0xfb/0x150 rcu_do_batch+0x595/0xc40 rcu_cpu_kthread+0x4e9/0x830 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 write to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8: rcu_preempt_deferred_qs_handler+0x1e/0x30 irq_work_single+0xaf/0x160 run_irq_workd+0x91/0xc0 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 no locks held by irq_work/8/88. irq event stamp: 200272 hardirqs last enabled at (200272): [] finish_task_switch+0x131/0x320 hardirqs last disabled at (200271): [] __schedule+0x129/0xd70 softirqs last enabled at (0): [] copy_process+0x4df/0x1cc0 softirqs last disabled at (0): [<0000000000000000>] 0x0 ------------------------------------------------------------------------ The problem is that irq-work handlers run with interrupts enabled, which means that rcu_preempt_deferred_qs_handler() could be interrupted, and that interrupt handler might contain an RCU read-side critical section, which might invoke rcu_read_unlock_special(). In the strict KCSAN mode of operation used by RCU, this constitutes a data race on the ->defer_qs_iw_pending field. This commit therefore disables interrupts across the portion of the rcu_preempt_deferred_qs_handler() that updates the ->defer_qs_iw_pending field. This suffices because this handler is not a fast path.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39752\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ARM: rockchip: fix kernel hang during smp initialization In order to bring up secondary CPUs main CPU write trampoline code to SRAM. The trampoline code is written while secondary CPUs are powered on (at least that true for RK3188 CPU). Sometimes that leads to kernel hang. Probably because secondary CPU execute trampoline code while kernel doesn't expect. The patch moves SRAM initialization step to the point where all secondary CPUs are powered down. That fixes rarely hangs on RK3188: [ 0.091568] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.091996] rockchip_smp_prepare_cpus: ncores 4\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-364 Signal Handler Race Condition\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39756\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c: WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288 This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN. Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate: - File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes - Multiple bitmaps: ~400MB - Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647) Reproducer: 1. Set /proc/sys/fs/nr_open to 1073741816: # echo 1073741816 > /proc/sys/fs/nr_open 2. Run a program that uses a high file descriptor: #include #include int main() { struct rlimit rlim = {1073741824, 1073741824}; setrlimit(RLIMIT_NOFILE, &rlim); dup2(2, 1073741880); // Triggers the warning return 0; } 3. Observe WARNING in dmesg at mm/slub.c:5027 systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that: 1. The kernel's allocation functions still enforce INT_MAX as a maximum size regardless of memcg accounting 2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations 3. The resulting allocations (>8GB) are impractical and will always fail systemd's algorithm starts with INT_MAX and keeps halving the value until the kernel accepts it. On most systems, this results in nr_open being set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors. While processes rarely use file descriptors near this limit in normal operation, certain selftests (like tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue. Fix this by adding a check in alloc_fdtable() to ensure the requested allocation size does not exceed INT_MAX. This causes the operation to fail with -EMFILE instead of triggering a kernel warning and avoids the impractical >8GB memory allocation request.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39757\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39759\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix race between quota disable and quota rescan ioctl There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fs_info->qgroup_tree rbtree. This happens as follows: 1) Task A enters btrfs_ioctl_quota_rescan() -> btrfs_qgroup_rescan(); 2) Task B enters btrfs_quota_disable() and calls btrfs_qgroup_wait_for_completion(), which does nothing because at that point fs_info->qgroup_rescan_running is false (it wasn't set yet by task A); 3) Task B calls btrfs_free_qgroup_config() which starts freeing qgroups from fs_info->qgroup_tree without taking the lock fs_info->qgroup_lock; 4) Task A enters qgroup_rescan_zero_tracking() which starts iterating the fs_info->qgroup_tree tree while holding fs_info->qgroup_lock, but task B is freeing qgroup records from that tree without holding the lock, resulting in a use-after-free. Fix this by taking fs_info->qgroup_lock at btrfs_free_qgroup_config(). Also at btrfs_qgroup_rescan() don't start the rescan worker if quotas were already disabled.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39760\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this up by checking the size first before looking at any of the fields in the descriptor.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39766\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \\ htb rate 64bit tc qdisc add dev lo parent 1:1 handle f: \\ cake memlimit 1b ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 This is because the low memlimit leads to a low buffer_limit, which causes packet dropping. However, cake_enqueue still returns NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an empty child qdisc. We should return NET_XMIT_CN when packets are dropped from the same tin and flow. I do not believe return value of NET_XMIT_CN is necessary for packet drops in the case of ack filtering, as that is meant to optimize performance, not to signal congestion.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39770\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM When performing Generic Segmentation Offload (GSO) on an IPv6 packet that contains extension headers, the kernel incorrectly requests checksum offload if the egress device only advertises NETIF_F_IPV6_CSUM feature, which has a strict contract: it supports checksum offload only for plain TCP or UDP over IPv6 and explicitly does not support packets with extension headers. The current GSO logic violates this contract by failing to disable the feature for packets with extension headers, such as those used in GREoIPv6 tunnels. This violation results in the device being asked to perform an operation it cannot support, leading to a `skb_warn_bad_offload` warning and a collapse of network throughput. While device TSO/USO is correctly bypassed in favor of software GSO for these packets, the GSO stack must be explicitly told not to request checksum offload. Mask NETIF_F_IPV6_CSUM, NETIF_F_TSO6 and NETIF_F_GSO_UDP_L4 in gso_features_check if the IPv6 header contains extension headers to compute checksum in software. The exception is a BIG TCP extension, which, as stated in commit 68e068cabd2c6c53 (\"net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets\"): \"The feature is only enabled on devices that support BIG TCP TSO. The header is only present for PF_PACKET taps like tcpdump, and not transmitted by physical devices.\" kernel log output (truncated): WARNING: CPU: 1 PID: 5273 at net/core/dev.c:3535 skb_warn_bad_offload+0x81/0x140 ... Call Trace: skb_checksum_help+0x12a/0x1f0 validate_xmit_skb+0x1a3/0x2d0 validate_xmit_skb_list+0x4f/0x80 sch_direct_xmit+0x1a2/0x380 __dev_xmit_skb+0x242/0x670 __dev_queue_xmit+0x3fc/0x7f0 ip6_finish_output2+0x25e/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_tnl_xmit+0x608/0xc00 [ip6_tunnel] ip6gre_tunnel_xmit+0x1c0/0x390 [ip6_gre] dev_hard_start_xmit+0x63/0x1c0 __dev_queue_xmit+0x6d0/0x7f0 ip6_finish_output2+0x214/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 inet6_csk_xmit+0xeb/0x150 __tcp_transmit_skb+0x555/0xa80 tcp_write_xmit+0x32a/0xe90 tcp_sendmsg_locked+0x437/0x1110 tcp_sendmsg+0x2f/0x50 ... skb linear: 00000000: e4 3d 1a 7d ec 30 e4 3d 1a 7e 5d 90 86 dd 60 0e skb linear: 00000010: 00 0a 1b 34 3c 40 20 11 00 00 00 00 00 00 00 00 skb linear: 00000020: 00 00 00 00 00 12 20 11 00 00 00 00 00 00 00 00 skb linear: 00000030: 00 00 00 00 00 11 2f 00 04 01 04 01 01 00 00 00 skb linear: 00000040: 86 dd 60 0e 00 0a 1b 00 06 40 20 23 00 00 00 00 skb linear: 00000050: 00 00 00 00 00 00 00 00 00 12 20 23 00 00 00 00 skb linear: 00000060: 00 00 00 00 00 00 00 00 00 11 bf 96 14 51 13 f9 skb linear: 00000070: ae 27 a0 a8 2b e3 80 18 00 40 5b 6f 00 00 01 01 skb linear: 00000080: 08 0a 42 d4 50 d5 4b 70 f8 1a\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-573 Improper Following of Specification by Caller\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39772\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/hisilicon/hibmc: fix the hibmc loaded failed bug When hibmc loaded failed, the driver use hibmc_unload to free the resource, but the mutexes in mode.config are not init, which will access an NULL pointer. Just change goto statement to return, because hibnc_hw_init() doesn't need to free anything.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39773\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() When set multicast_query_interval to a large value, the local variable 'time' in br_multicast_send_query() may overflow. If the time is smaller than jiffies, the timer will expire immediately, and then call mod_timer() again, which creates a loop and may trigger the following soft lockup issue. watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rb_consumer:66] CPU: 1 UID: 0 PID: 66 Comm: rb_consumer Not tainted 6.16.0+ #259 PREEMPT(none) Call Trace: __netdev_alloc_skb+0x2e/0x3a0 br_ip6_multicast_alloc_query+0x212/0x1b70 __br_multicast_send_query+0x376/0xac0 br_multicast_send_query+0x299/0x510 br_multicast_query_expired.constprop.0+0x16d/0x1b0 call_timer_fn+0x3b/0x2a0 __run_timers+0x619/0x950 run_timer_softirq+0x11c/0x220 handle_softirqs+0x18e/0x560 __irq_exit_rcu+0x158/0x1a0 sysvec_apic_timer_interrupt+0x76/0x90 This issue can be reproduced with: ip link add br0 type bridge echo 1 > /sys/class/net/br0/bridge/multicast_querier echo 0xffffffffffffffff > /sys/class/net/br0/bridge/multicast_query_interval ip link set dev br0 up The multicast_startup_query_interval can also cause this issue. Similar to the commit 99b40610956a (\"net: bridge: mcast: add and enforce query interval minimum\"), add check for the query interval maximum to fix this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39776\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: clear page table entries at destroy_args() The mm/debug_vm_pagetable test allocates manually page table entries for the tests it runs, using also its manually allocated mm_struct. That in itself is ok, but when it exits, at destroy_args() it fails to clear those entries with the *_clear functions. The problem is that leaves stale entries. If another process allocates an mm_struct with a pgd at the same address, it may end up running into the stale entry. This is happening in practice on a debug kernel with CONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra debugging I added (it prints a warning trace if pgtables_bytes goes negative, in addition to the warning at check_mm() function): [ 2.539353] debug_vm_pgtable: [get_random_vaddr ]: random_vaddr is 0x7ea247140000 [ 2.539366] kmem_cache info [ 2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508 [ 2.539447] debug_vm_pgtable: [init_args ]: args->mm is 0x000000002267cc9e (...) [ 2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0 [ 2.552816] Modules linked in: [ 2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY [ 2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries [ 2.552872] NIP: c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90 [ 2.552885] REGS: c0000000622e73b0 TRAP: 0700 Not tainted (6.12.0-105.debug_vm2.el10.ppc64le+debug) [ 2.552899] MSR: 800000000282b033 CR: 24002822 XER: 0000000a [ 2.552954] CFAR: c0000000008f03f0 IRQMASK: 0 [ 2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001 [ 2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff [ 2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000 [ 2.552954] GPR12: 00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb [ 2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0 [ 2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000 [ 2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001 [ 2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760 [ 2.553170] NIP [c0000000007eef3c] free_pud_range+0x8bc/0x8d0 [ 2.553185] LR [c0000000007eef30] free_pud_range+0x8b0/0x8d0 [ 2.553199] Call Trace: [ 2.553207] [c0000000622e7650] [c0000000007eef30] free_pud_range+0x8b0/0x8d0 (unreliable) [ 2.553229] [c0000000622e7750] [c0000000007f40b4] free_pgd_range+0x284/0x3b0 [ 2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables+0x450/0x570 [ 2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap+0x250/0x650 [ 2.553292] [c0000000622e7a30] [c0000000001b95b8] __mmput+0x98/0x290 [ 2.558344] [c0000000622e7a80] [c0000000001d1018] exit_mm+0x118/0x1b0 [ 2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit+0x2ec/0x870 [ 2.558376] [c0000000622e7b60] [c0000000001d1ca8] do_group_exit+0x88/0x150 [ 2.558391] [c0000000622e7bb0] [c0000000001d1db8] sys_exit_group+0x48/0x50 [ 2.558407] [c0000000622e7be0] [c00000000003d810] system_call_exception+0x1e0/0x4c0 [ 2.558423] [c0000000622e7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec (...) [ 2.558892] ---[ end trace 0000000000000000 ]--- [ 2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1 [ 2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144 Here the modprobe process ended up with an allocated mm_struct from the mm_struct slab that was used before by the debug_vm_pgtable test. That is not a problem, since the mm_stru ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39782\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2_log_do_checkpoint() Both jbd2_log_do_checkpoint() and jbd2_journal_shrink_checkpoint_list() periodically release j_list_lock after processing a batch of buffers to avoid long hold times on the j_list_lock. However, since both functions contend for j_list_lock, the combined time spent waiting and processing can be significant. jbd2_journal_shrink_checkpoint_list() explicitly calls cond_resched() when need_resched() is true to avoid softlockups during prolonged operations. But jbd2_log_do_checkpoint() only exits its loop when need_resched() is true, relying on potentially sleeping functions like __flush_batch() or wait_on_buffer() to trigger rescheduling. If those functions do not sleep, the kernel may hit a softlockup. watchdog: BUG: soft lockup - CPU#3 stuck for 156s! [kworker/u129:2:373] CPU: 3 PID: 373 Comm: kworker/u129:2 Kdump: loaded Not tainted 6.6.0+ #10 Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.27 06/13/2017 Workqueue: writeback wb_workfn (flush-7:2) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : native_queued_spin_lock_slowpath+0x358/0x418 lr : jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] Call trace: native_queued_spin_lock_slowpath+0x358/0x418 jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] __jbd2_log_wait_for_space+0xfc/0x2f8 [jbd2] add_transaction_credits+0x3bc/0x418 [jbd2] start_this_handle+0xf8/0x560 [jbd2] jbd2__journal_start+0x118/0x228 [jbd2] __ext4_journal_start_sb+0x110/0x188 [ext4] ext4_do_writepages+0x3dc/0x740 [ext4] ext4_writepages+0xa4/0x190 [ext4] do_writepages+0x94/0x228 __writeback_single_inode+0x48/0x318 writeback_sb_inodes+0x204/0x590 __writeback_inodes_wb+0x54/0xf8 wb_writeback+0x2cc/0x3d8 wb_do_writeback+0x2e0/0x2f8 wb_workfn+0x80/0x2a8 process_one_work+0x178/0x3e8 worker_thread+0x234/0x3b8 kthread+0xf0/0x108 ret_from_fork+0x10/0x20 So explicitly call cond_resched() in jbd2_log_do_checkpoint() to avoid softlockup.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39783\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, not a list entry. This list_del() call triggers a KASAN warning when an endpoint function driver which has a configfs attribute group is torn down: ================================================================== BUG: KASAN: slab-use-after-free in pci_epf_remove_cfs+0x17c/0x198 Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319 CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE Hardware name: Radxa ROCK 5B (DT) Call trace: show_stack+0x2c/0x84 (C) dump_stack_lvl+0x70/0x98 print_report+0x17c/0x538 kasan_report+0xb8/0x190 __asan_report_store8_noabort+0x20/0x2c pci_epf_remove_cfs+0x17c/0x198 pci_epf_unregister_driver+0x18/0x30 nvmet_pci_epf_cleanup_module+0x24/0x30 [nvmet_pci_epf] __arm64_sys_delete_module+0x264/0x424 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xac/0x230 do_el0_svc+0x40/0x58 el0_svc+0x48/0xdc el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c ... Remove this incorrect list_del() call from pci_epf_remove_cfs().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39787\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdt_loader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39788\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the driver ends up programming the UTRL_NEXUS_TYPE incorrectly as 0. This is because the left hand side of the shift is 1, which is of type int, i.e. 31 bits wide. Shifting by more than that width results in undefined behaviour. Fix this by switching to the BIT() macro, which applies correct type casting as required. This ensures the correct value is written to UTRL_NEXUS_TYPE (0xffffffff on gs101), and it also fixes a UBSAN shift warning: UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21 shift exponent 32 is too large for 32-bit type 'int' For consistency, apply the same change to the nutmrs / UTMRL_NEXUS_TYPE write.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39790\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a read pointer that is multiple elements ahead of the host's read pointer. For instance, if the host accesses an event ring while the device is updating it, the pointer inside of the event might still point to an old TRE. If the host uses the channel's xfer_cb() to directly free the buffer pointed to by the TRE, the buffer will be double-freed. This behavior was observed on an ep that used upstream EP stack without 'commit 6f18d174b73d (\"bus: mhi: ep: Update read pointer only after buffer is written\")'. Where the device updated the events ring pointer before updating the event contents, so it left a window where the host was able to access the stale data the event pointed to, before the device had the chance to update them. The usual pattern was that the host received an event pointing to a TRE that is not immediately after the last processed one, so it got treated as if it was a chained transaction, processing all of the TREs in between the two read pointers. This commit aims to harden the host by ensuring transactions where the event points to a TRE that isn't local_rp + 1 are chained. [mani: added stable tag and reworded commit message]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-415 Double Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.7\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39794\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ARM: tegra: Use I/O memcpy to write to IRAM Kasan crashes the kernel trying to check boundaries when using the normal memcpy.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39795\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: block: avoid possible overflow for chunk_sectors check in blk_stack_limits() In blk_stack_limits(), we check that the t->chunk_sectors value is a multiple of the t->physical_block_size value. However, by finding the chunk_sectors value in bytes, we may overflow the unsigned int which holds chunk_sectors, so change the check to be based on sectors.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-674 Uncontrolled Recursion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39798\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: NFS: Fix the setting of capabilities when automounting a new filesystem Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, and then probed for again.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-273 Improper Check for Dropped Privileges\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39800\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() If we find an unexpected generation for the extent buffer we are cloning at btrfs_copy_root(), we just WARN_ON() and don't error out and abort the transaction, meaning we allow to persist metadata with an unexpected generation. Instead of warning only, abort the transaction and return -EUCLEAN.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39801\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARN_ON for device endpoint command timeouts This commit addresses a rarely observed endpoint command timeout which causes kernel panic due to warn when 'panic_on_warn' is enabled and unnecessary call trace prints when 'panic_on_warn' is disabled. It is seen during fast software-controlled connect/disconnect testcases. The following is one such endpoint command timeout that we observed: 1. Connect ======= ->dwc3_thread_interrupt ->dwc3_ep0_interrupt ->configfs_composite_setup ->composite_setup ->usb_ep_queue ->dwc3_gadget_ep0_queue ->__dwc3_gadget_ep0_queue ->__dwc3_ep0_do_control_data ->dwc3_send_gadget_ep_cmd 2. Disconnect ========== ->dwc3_thread_interrupt ->dwc3_gadget_disconnect_interrupt ->dwc3_ep0_reset_state ->dwc3_ep0_end_control_data ->dwc3_send_gadget_ep_cmd In the issue scenario, in Exynos platforms, we observed that control transfers for the previous connect have not yet been completed and end transfer command sent as a part of the disconnect sequence and processing of USB_ENDPOINT_HALT feature request from the host timeout. This maybe an expected scenario since the controller is processing EP commands sent as a part of the previous connect. It maybe better to remove WARN_ON in all places where device endpoint commands are sent to avoid unnecessary kernel panic due to warn.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39806\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes. mt_report_fixup() attempts to patch byte offset 607 of the descriptor with 0x25 by first checking if byte offset 607 is 0x15 however it lacks bounds checks to verify if the descriptor is big enough before conducting this check. Fix this bug by ensuring the descriptor size is at least 608 bytes before accessing it. Below is the KASAN splat after the out of bounds access happens: [ 13.671954] ================================================================== [ 13.672667] BUG: KASAN: slab-out-of-bounds in mt_report_fixup+0x103/0x110 [ 13.673297] Read of size 1 at addr ffff888103df39df by task kworker/0:1/10 [ 13.673297] [ 13.673297] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-00005-gec5d573d83f4-dirty #3 [ 13.673297] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/04 [ 13.673297] Call Trace: [ 13.673297] [ 13.673297] dump_stack_lvl+0x5f/0x80 [ 13.673297] print_report+0xd1/0x660 [ 13.673297] kasan_report+0xe5/0x120 [ 13.673297] __asan_report_load1_noabort+0x18/0x20 [ 13.673297] mt_report_fixup+0x103/0x110 [ 13.673297] hid_open_report+0x1ef/0x810 [ 13.673297] mt_probe+0x422/0x960 [ 13.673297] hid_device_probe+0x2e2/0x6f0 [ 13.673297] really_probe+0x1c6/0x6b0 [ 13.673297] __driver_probe_device+0x24f/0x310 [ 13.673297] driver_probe_device+0x4e/0x220 [ 13.673297] __device_attach_driver+0x169/0x320 [ 13.673297] bus_for_each_drv+0x11d/0x1b0 [ 13.673297] __device_attach+0x1b8/0x3e0 [ 13.673297] device_initial_probe+0x12/0x20 [ 13.673297] bus_probe_device+0x13d/0x180 [ 13.673297] device_add+0xe3a/0x1670 [ 13.673297] hid_add_device+0x31d/0xa40 [...]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39808\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger page fault error for address(0xffffffffffffff58) add null check logic to ntrig_report_version() before calling hid_to_usb_dev()\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39812\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior. Clear sin6_scope_id and sin6_flowinfo. BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390 sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452 sctp_get_port net/sctp/socket.c:8523 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable addr.i.i created at: sctp_get_port net/sctp/socket.c:8515 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39813\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition. The issue occurs because: CPU0 (ftrace_dump) CPU1 (reader) echo z > /proc/sysrq-trigger !trace_empty(&iter) trace_iterator_reset(&iter) <- len = size = 0 cat /sys/kernel/tracing/trace_pipe trace_find_next_entry_inc(&iter) __find_next_entry ring_buffer_empty_cpu <- all empty return NULL trace_printk_seq(&iter.seq) WARN_ON_ONCE(s->seq.len >= s->seq.size) In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers. This caused trace_find_next_entry_inc to return NULL, failing to populate `iter.seq`. At this point, due to the prior trace_iterator_reset, both `iter.seq.len` and `iter.seq.size` were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered. Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39817\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe8/0x190 __asan_loadN+0x1c/0x28 memcmp+0x98/0xd0 efivarfs_d_compare+0x68/0xd8 __d_lookup_rcu_op_compare+0x178/0x218 __d_lookup_rcu+0x1f8/0x228 d_alloc_parallel+0x150/0x648 lookup_open.isra.0+0x5f0/0x8d0 open_last_lookups+0x264/0x828 path_openat+0x130/0x3f8 do_filp_open+0x114/0x248 do_sys_openat2+0x340/0x3c0 __arm64_sys_openat+0x120/0x1a0 If dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become negative, leadings to oob. The issue can be triggered by parallel lookups using invalid filename: T1 T2 lookup_open ->lookup simple_lookup d_add // invalid dentry is added to hash list lookup_open d_alloc_parallel __d_lookup_rcu __d_lookup_rcu_op_compare hlist_bl_for_each_entry_rcu // invalid dentry can be retrieved ->d_compare efivarfs_d_compare // oob Fix it by checking 'guid' before cmp.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39819\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/smb: Fix inconsistent refcnt update A possible inconsistent update of refcount was identified in `smb2_compound_op`. Such inconsistent update could lead to possible resource leaks. Why it is a possible bug: 1. In the comment section of the function, it clearly states that the reference to `cfile` should be dropped after calling this function. 2. Every control flow path would check and drop the reference to `cfile`, except the patched one. 3. Existing callers would not handle refcount update of `cfile` if -ENOMEM is returned. To fix the bug, an extra goto label \"out\" is added, to make sure that the cleanup logic would always be respected. As the problem is caused by the allocation failure of `vars`, the cleanup logic between label \"finished\" and \"out\" can be safely ignored. According to the definition of function `is_replayable_error`, the error code of \"-ENOMEM\" is not recoverable. Therefore, the replay logic also gets ignored.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39823\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39824\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device. This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees. 0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection Below is the KASAN splat after triggering the UAF: [ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700] __kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700] __kasan_slab_free+0x3c/0x50 [ 21.673700] kfre ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39825\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file. Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39826\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths. For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues. This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39827\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock. This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of rose_neigh->use when rose_neigh->count is incremented or decremented. This patch also modifies rose_rt_free(), rose_rt_device_down() and rose_clear_route() to properly release references to rose_neigh objects before freeing a rose_node through rose_remove_node(). These changes ensure rose_neigh structures are properly freed only when all references, including those from rose_node structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39828\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). syzbot reported the splat below. [0] When atmtcp_v_open() or atmtcp_v_close() is called via connect() or close(), atmtcp_send_control() is called to send an in-kernel special message. The message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length. Also, a pointer of struct atm_vcc is set to atmtcp_control.vcc. The notable thing is struct atmtcp_control is uAPI but has a space for an in-kernel pointer. struct atmtcp_control { struct atmtcp_hdr hdr; /* must be first */ ... atm_kptr_t vcc; /* both directions */ ... } __ATM_API_ALIGN; typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t; The special message is processed in atmtcp_recv_control() called from atmtcp_c_send(). atmtcp_c_send() is vcc->dev->ops->send() and called from 2 paths: 1. .ndo_start_xmit() (vcc->send() == atm_send_aal0()) 2. vcc_sendmsg() The problem is sendmsg() does not validate the message length and userspace can abuse atmtcp_recv_control() to overwrite any kptr by atmtcp_control. Let's add a new ->pre_send() hook to validate messages from sendmsg(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI KASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f] CPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline] RIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297 Code: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c RSP: 0018:ffffc90003f5f810 EFLAGS: 00010203 RAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c RBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd R10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000 R13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff FS: 00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0 Call Trace: vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8d7e96a4a9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9 RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005 RBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac R13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250 Modules linked in:\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39835\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: xfs: do not propagate ENODATA disk errors into xattr code ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code; namely, that the requested attribute name could not be found. However, a medium error from disk may also return ENODATA. At best, this medium error may escape to userspace as \"attribute not found\" when in fact it's an IO (disk) error. At worst, we may oops in xfs_attr_leaf_get() when we do: error = xfs_attr_leaf_hasname(args, &bp); if (error == -ENOATTR) { xfs_trans_brelse(args->trans, bp); return error; } because an ENODATA/ENOATTR error from disk leaves us with a null bp, and the xfs_trans_brelse will then null-deref it. As discussed on the list, we really need to modify the lower level IO functions to trap all disk errors and ensure that we don't let unique errors like this leak up into higher xfs functions - many like this should be remapped to EIO. However, this patch directly addresses a reported bug in the xattr code, and should be safe to backport to stable kernels. A larger-scope patch to handle more unique errors at lower levels can follow later. (Note, prior to 07120f1abdff we did not oops, but we did return the wrong error code to userspace.)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39838\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash. This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and returns NULL early to prevent dereferencing NULL pointer. Found by Linux Verification Center (linuxtesting.org) with SVACE\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39839\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39841\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF. Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39842\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already been executed in ocfs2_dismount_volume(), so osb->journal must be NULL. Therefore, the following calltrace will inevitably fail when it reaches jbd2_journal_release_jbd_inode(). ocfs2_dismount_volume()-> ocfs2_delete_osb()-> ocfs2_free_slot_info()-> __ocfs2_free_slot_info()-> evict()-> ocfs2_evict_inode()-> ocfs2_clear_inode()-> jbd2_journal_release_jbd_inode(osb->journal->j_journal, Adding osb->journal checks will prevent null-ptr-deref during the above execution path.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39843\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but when enabled CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare, and try to hold the per_cpu(hrtimer_bases)[n].lock. Avoid deadlock caused by implicitly waking up kswapd by passing in allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the debug_objects_fill_pool() case. Inside stack depot they are processed by gfp_nested_mask(). Since ___slab_alloc() has preemption disabled, we mask out __GFP_DIRECT_RECLAIM from the flags there. The oops looks something like: BUG: spinlock recursion on CPU#3, swapper/3/0 lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3 Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT) Call trace: spin_bug+0x0 _raw_spin_lock_irqsave+0x80 hrtimer_try_to_cancel+0x94 task_contending+0x10c enqueue_dl_entity+0x2a4 dl_server_start+0x74 enqueue_task_fair+0x568 enqueue_task+0xac do_activate_task+0x14c ttwu_do_activate+0xcc try_to_wake_up+0x6c8 default_wake_function+0x20 autoremove_wake_function+0x1c __wake_up+0xac wakeup_kswapd+0x19c wake_all_kswapds+0x78 __alloc_pages_slowpath+0x1ac __alloc_pages_noprof+0x298 stack_depot_save_flags+0x6b0 stack_depot_save+0x14 set_track_prepare+0x5c ___slab_alloc+0xccc __kmalloc_cache_noprof+0x470 __set_page_owner+0x2bc post_alloc_hook[jt]+0x1b8 prep_new_page+0x28 get_page_from_freelist+0x1edc __alloc_pages_noprof+0x13c alloc_slab_page+0x244 allocate_slab+0x7c ___slab_alloc+0x8e8 kmem_cache_alloc_noprof+0x450 debug_objects_fill_pool+0x22c debug_object_activate+0x40 enqueue_hrtimer[jt]+0xdc hrtimer_start_range_ns+0x5f8 ...\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39844\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm: move page table sync declarations to linux/pgtable.h During our internal testing, we started observing intermittent boot failures when the machine uses 4-level paging and has a large amount of persistent memory: BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] It turns out that the kernel panics while initializing vmemmap (struct page array) when the vmemmap region spans two PGD entries, because the new PGD entry is only installed in init_mm.pgd, but not in the page tables of other tasks. And looking at __populate_section_memmap(): if (vmemmap_can_optimize(altmap, pgmap)) // does not sync top level page tables r = vmemmap_populate_compound_pages(pfn, start, end, nid, pgmap); else // sync top level page tables in x86 r = vmemmap_populate(start, end, nid, altmap); In the normal path, vmemmap_populate() in arch/x86/mm/init_64.c synchronizes the top level page table (See commit 9b861528a801 (\"x86-64, mem: Update all PGDs for direct mapping and vmemmap mapping changes\")) so that all tasks in the system can see the new vmemmap area. However, when vmemmap_can_optimize() returns true, the optimized path skips synchronization of top-level page tables. This is because vmemmap_populate_compound_pages() is implemented in core MM code, which does not handle synchronization of the top-level page tables. Instead, the core MM has historically relied on each architecture to perform this synchronization manually. We're not the first party to encounter a crash caused by not-sync'd top level page tables: earlier this year, Gwan-gyeong Mun attempted to address the issue [1] [2] after hitting a kernel panic when x86 code accessed the vmemmap area before the corresponding top-level entries were synced. At that time, the issue was believed to be triggered only when struct page was enlarged for debugging purposes, and the patch did not get further updates. It turns out that current approach of relying on each arch to handle the page table sync manually is fragile because 1) it's easy to forget to sync the top level page table, and 2) it's also easy to overlook that the kernel should not access the vmemmap and direct mapping areas before the sync. # The solution: Make page table sync more code robust and harder to miss To address this, Dave Hansen suggested [3] [4] introducing {pgd,p4d}_populate_kernel() for updating kernel portion of the page tables and allow each architecture to explicitly perform synchronization when installing top-level entries. With this approach, we no longer need to worry about missing the sync step, reducing the risk of future regressions. The new interface reuses existing ARCH_PAGE_TABLE_SYNC_MASK, PGTBL_P*D_MODIFIED and arch_sync_kernel_mappings() facility used by vmalloc and ioremap to synchronize page tables. pgd_populate_kernel() looks like this: static inline void pgd_populate_kernel(unsigned long addr, pgd_t *pgd, p4d_t *p4d) { pgd_populate(&init_mm, pgd, p4d); if (ARCH_PAGE_TABLE_SYNC_MASK & PGTBL_PGD_MODIFIED) arch_sync_kernel_mappings(addr, addr); } It is worth noting that vmalloc() and apply_to_range() carefully synchronizes page tables by calling p*d_alloc_track() and arch_sync_kernel_mappings(), and thus they are not affected by ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39845\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() Define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to ensure page tables are properly synchronized when calling p*d_populate_kernel(). For 5-level paging, synchronization is performed via pgd_populate_kernel(). In 4-level paging, pgd_populate() is a no-op, so synchronization is instead performed at the P4D level via p4d_populate_kernel(). This fixes intermittent boot failures on systems using 4-level paging and a large amount of persistent memory: BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] It also fixes a crash in vmemmap_set_pmd() caused by accessing vmemmap before sync_global_pgds() [1]: BUG: unable to handle page fault for address: ffffeb3ff1200000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: Oops: 0002 [#1] PREEMPT SMP NOPTI Tainted: [W]=WARN RIP: 0010:vmemmap_set_pmd+0xff/0x230 vmemmap_populate_hugepages+0x176/0x180 vmemmap_populate+0x34/0x80 __populate_section_memmap+0x41/0x90 sparse_add_section+0x121/0x3e0 __add_pages+0xba/0x150 add_pages+0x1d/0x70 memremap_pages+0x3dc/0x810 devm_memremap_pages+0x1c/0x60 xe_devm_add+0x8b/0x100 [xe] xe_tile_init_noalloc+0x6a/0x70 [xe] xe_device_probe+0x48c/0x740 [xe] [... snip ...]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39846\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() In __iodyn_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource(). Fix this bug by adding a check of res.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39847\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ppp: fix memory leak in pad_compress_skb If alloc_skb() fails in pad_compress_skb(), it returns NULL without releasing the old skb. The caller does: skb = pad_compress_skb(ppp, skb); if (!skb) goto drop; drop: kfree_skb(skb); When pad_compress_skb() returns NULL, the reference to the old skb is lost and kfree_skb(skb) ends up doing nothing, leading to a memory leak. Align pad_compress_skb() semantics with realloc(): only free the old skb if allocation and compression succeed. At the call site, use the new_skb variable so the original skb is not lost when pad_compress_skb() fails.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-772 Missing Release of Resource after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39848\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d (\"net: introduce per netns packet chains\"). skb->dev becomes NULL and we crash in __netif_receive_skb_core(). Before above commit, different kind of bugs or corruptions could happen without a major crash. But the root cause is that ax25_kiss_rcv() can queue/mangle input skb without checking if this skb is shared or not. Many thanks to Bernard Pidoux for his help, diagnosis and tests. We had a similar issue years ago fixed with commit 7aaed57c5c28 (\"phonet: properly unshare skbs in phonet_rcv()\").\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39849\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checking.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39853\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. Fix this by using list_first_entry_or_null instead of list_first_entry.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39857\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G OE 6.17.0-rc2+ #9 NONE Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Workqueue: smc_hs_wq smc_listen_work [smc] RIP: 0010:smc_ib_is_sg_need_sync+0x9e/0xd0 [smc] ... Call Trace: smcr_buf_map_link+0x211/0x2a0 [smc] __smc_buf_create+0x522/0x970 [smc] smc_buf_create+0x3a/0x110 [smc] smc_find_rdma_v2_device_serv+0x18f/0x240 [smc] ? smc_vlan_by_tcpsk+0x7e/0xe0 [smc] smc_listen_find_device+0x1dd/0x2b0 [smc] smc_listen_work+0x30f/0x580 [smc] process_one_work+0x18c/0x340 worker_thread+0x242/0x360 kthread+0xe7/0x220 ret_from_fork+0x13a/0x160 ret_from_fork_asm+0x1a/0x30 If the software RoCE device is used, ibdev->dma_device is a null pointer. As a result, the problem occurs. Null pointer detection is added to prevent problems.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39860\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the \"Freed by task\" part. Let's call l2cap_sock_cleanup_listen() under lock_sock() in l2cap_sock_release(). [0]: BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 Read of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995 CPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 spin_lock_bh include/linux/spinlock.h:356 [inline] release_sock+0x21/0x220 net/core/sock.c:3746 bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2accf8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f R10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c R13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490 Allocated by task 5326: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4365 [inline] __kmalloc_nopro ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39864\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f (\"cfg80211: track hidden SSID networks properly\"), adjust cfg80211_update_known_bss() to free the last beacon frame elements only if they're not shared via the corresponding 'hidden_beacon_bss' pointer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39865\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer dereference in tee_shm_put tee_shm_put have NULL pointer dereference: __optee_disable_shm_cache --> shm = reg_pair_to_ptr(...);//shm maybe return NULL tee_shm_free(shm); --> tee_shm_put(shm);//crash Add check in tee_shm_put to fix it. panic log: Unable to handle kernel paging request at virtual address 0000000000100cca Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 [0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- 6.6.0-39-generic #38 Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 10/26/2022 pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tee_shm_put+0x24/0x188 lr : tee_shm_free+0x14/0x28 sp : ffff001f98f9faf0 x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca Call trace: tee_shm_put+0x24/0x188 tee_shm_free+0x14/0x28 __optee_disable_shm_cache+0xa8/0x108 optee_shutdown+0x28/0x38 platform_shutdown+0x28/0x40 device_shutdown+0x144/0x2b0 kernel_power_off+0x3c/0x80 hibernate+0x35c/0x388 state_store+0x64/0x80 kobj_attr_store+0x14/0x28 sysfs_kf_write+0x48/0x60 kernfs_fop_write_iter+0x128/0x1c0 vfs_write+0x270/0x370 ksys_write+0x6c/0x100 __arm64_sys_write+0x20/0x30 invoke_syscall+0x4c/0x120 el0_svc_common.constprop.0+0x44/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x24/0x88 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x14c/0x15\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39866\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mark_inode_dirty+0x124/0x418 lr : __mark_inode_dirty+0x118/0x418 sp : ffffffc08c9dbbc0 ........ Call trace: __mark_inode_dirty+0x124/0x418 generic_update_time+0x4c/0x60 file_modified+0xcc/0xd0 ext4_buffered_write_iter+0x58/0x124 ext4_file_write_iter+0x54/0x704 vfs_write+0x1c0/0x308 ksys_write+0x74/0x10c __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x40/0xe4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x194/0x198 Root cause is: systemd-random-seed kworker ---------------------------------------------------------------------- ___mark_inode_dirty inode_switch_wbs_work_fn spin_lock(&inode->i_lock); inode_attach_wb locked_inode_to_wb_and_lock_list get inode->i_wb spin_unlock(&inode->i_lock); spin_lock(&wb->list_lock) spin_lock(&inode->i_lock) inode_io_list_move_locked spin_unlock(&wb->list_lock) spin_unlock(&inode->i_lock) spin_lock(&old_wb->list_lock) inode_do_switch_wbs spin_lock(&inode->i_lock) inode->i_wb = new_wb spin_unlock(&inode->i_lock) spin_unlock(&old_wb->list_lock) wb_put_many(old_wb, nr_switched) cgwb_release old wb released wb_wakeup_delayed() accesses wb, then trigger the use-after-free issue Fix this race condition by holding inode spinlock until wb_wakeup_delayed() finished.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-40300\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest. Userspace can additionally be protected by flushing the branch predictors after a VMexit. Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and userspace will incur the most overhead from the new IBPB. This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is doubled up: one at context switch and another before running userspace. The intent is to integrate and optimize these cases post-embargo. [ dhansen: elaborate on suboptimal IBPB solution ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-43368\n<div class=\"csaf-accordion-content\">\n\nA use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-47219\n<div class=\"csaf-accordion-content\">\n\nIn GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n8.1\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-48989\n<div class=\"csaf-accordion-content\">\n\nImproper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-404 Improper Resource Shutdown or Release\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-53057\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-284 Improper Access Control\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-53066\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-55752\n<div class=\"csaf-accordion-content\">\n\nRelative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-23 Relative Path Traversal\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-55754\n<div class=\"csaf-accordion-content\">\n\nImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n9.6\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-61748\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-284 Improper Access Control\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.7\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-61795\n<div class=\"csaf-accordion-content\">\n\nImproper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-404 Improper Resource Shutdown or Release\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-2673\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21925\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.8\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21932\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.4\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21933\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.1\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21945\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-400 Uncontrolled Resource Consumption\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21947\n<div class=\"csaf-accordion-content\">\n\nVulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.1\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-22924\n<div class=\"csaf-accordion-content\">\n\nThe affected application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion conditions. This could allow an attacker to disrupt normal operations or perform unauthorized actions, potentially impacting system availability and integrity.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-306 Missing Authentication for Critical Function\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n9.1\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-22925\n<div class=\"csaf-accordion-content\">\n\nThe affected application is susceptible to resource exhaustion when subjected to high volume of TCP SYN packets This could allow an attacker to render the service unavailable and cause denial-of-service conditions by overwhelming system resources.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28387\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage. By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable. The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records. No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28388\n<div class=\"csaf-accordion-content\">\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28389\n<div class=\"csaf-accordion-content\">\n\nIssue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28390\n<div class=\"csaf-accordion-content\">\n\nIssue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-31789\n<div class=\"csaf-accordion-content\">\n\nIssue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the size of the buffer needed for the result is calculated as multiplication of the input length by 3. On 32 bit platforms, this multiplication may overflow resulting in the allocation of a smaller buffer and a heap buffer overflow. Applications and services that print or log contents of untrusted X.509 certificates are vulnerable to this issue. As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-31790\n<div class=\"csaf-accordion-content\">\n\nIssue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-754 Improper Check for Unusual or Exceptional Conditions\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n</div>\n\n\n\nAcknowledgments\n\n\n\nSiemens ProductCERT reported these vulnerabilities to CISA.\n\n\n\n\nGeneral Recommendations\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\n\n\nAdditional Resources\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories\n\n\n\nTerms of Use\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.\n\n\n\nLegal Notice and Terms of Use\n\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).\n\n\n\nRecommended Practices\n\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.\n\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.\n\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.\n\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.\n\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\n\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\n\n\n\nAdvisory Conversion Disclaimer\n\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-032379 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.\n\nRevision History\n\n\n\nInitial Release Date: 2026-05-12\n\n\n\n\n\nDate\nRevision\nSummary\n\n\n\n\n2026-05-12\n1\nPublication Date\n\n\n2026-05-14\n2\nInitial CISA Republication of Siemens ProductCERT SSA-032379 advisory\n\n\n\n\n\n\nLegal Notice and Terms of Use", "creation_timestamp": "2026-05-14T10:00:00.000000Z"}, {"uuid": "6326d396-58a3-46a8-b53c-9d4339a8790c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28388", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10", "content": "View CSAF\n\nSummary\n\nSIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.\n\nThe following versions of Siemens SIMATIC are affected:\n\n\n\nSIMATIC CN 4100 vers:intdot/<5.0 \n\n<div class=\"csaf-table\">\n\n\n\n\nCVSS\nVendor\nEquipment\nVulnerabilities\n\n\n\n\nv3 9.6\nSiemens\nSiemens SIMATIC\nNULL Pointer Dereference, Reachable Assertion, Use After Free, Out-of-bounds Write, Integer Overflow or Wraparound, Allocation of Resources Without Limits or Throttling, Out-of-bounds Read, Covert Timing Channel, Stack-based Buffer Overflow, Inefficient Algorithmic Complexity, Missing Release of Memory after Effective Lifetime, Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Input Validation, Improper Locking, Uncontrolled Recursion, Buffer Access with Incorrect Length Value, Race Condition within a Thread, Missing Synchronization, Use of Uninitialized Resource, Double Free, Missing Release of Resource after Effective Lifetime, Loop with Unreachable Exit Condition ('Infinite Loop'), Improper Update of Reference Count, Improper Control of a Resource Through its Lifetime, Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), Unexpected Status Code or Return Value, Divide By Zero, Improper Validation of Specified Index, Position, or Offset in Input, Comparison Using Wrong Factors, Observable Timing Discrepancy, Improper Validation of Syntactic Correctness of Input, Deadlock, Signal Handler Race Condition, Improper Following of Specification by Caller, Improper Check for Dropped Privileges, Transmission of Private Resources into a New Sphere ('Resource Leak'), Improper Resource Shutdown or Release, Improper Access Control, Exposure of Sensitive Information to an Unauthorized Actor, Relative Path Traversal, Improper Neutralization of Escape, Meta, or Control Sequences, Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade'), Uncontrolled Resource Consumption, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Missing Authentication for Critical Function, Improper Check for Unusual or Exceptional Conditions\n\n\n\n</div>\n\nBackground\n\n\n\nCritical Infrastructure Sectors: Critical Manufacturing\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: Germany\n\n\n\n\nVulnerabilities\n<div class=\"csaf-accordion\">\n\nExpand All +\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-47704\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check link_res->hpo_dp_link_enc before using it [WHAT & HOW] Functions dp_enable_link_phy and dp_disable_link_phy can pass link_res without initializing hpo_dp_link_enc and it is necessary to check for null before dereferencing. This fixes 2 FORWARD_NULL issues reported by Coverity.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-57924\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding file handles is usually performed by a filesystem >encode_fh() method that may fail for various reasons. The legacy users of exportfs_encode_fh(), namely, nfsd and name_to_handle_at(2) syscall are ready to cope with the possibility of failure to encode a file handle. There are a few other users of exportfs_encode_{fh,fid}() that currently have a WARN_ON() assertion when ->encode_fh() fails. Relax those assertions because they are wrong. The second linked bug report states commit 16aac5ad1fa9 (\"ovl: support encoding non-decodable file handles\") in v6.6 as the regressing commit, but this is not accurate. The aforementioned commit only increases the chances of the assertion and allows triggering the assertion with the reproducer using overlayfs, inotify and drop_caches. Triggering this assertion was always possible with other filesystems and other reasons of ->encode_fh() failures and more particularly, it was also possible with the exact same reproducer using overlayfs that is mounted with options index=on,nfs_export=on also on kernels < v6.6. Therefore, I am not listing the aforementioned commit as a Fixes commit. Backport hint: this patch will have a trivial conflict applying to v6.6.y, and other trivial conflicts applying to stable kernels < v6.6.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-617 Reachable Assertion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-58240\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result. We should preferably also use a separate crypto_wait. I'm not seeing a UAF as I did in the past, I think aec7961916f3 (\"tls: fix race between async notify and socket close\") took care of it. This will make the next fix easier.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.3\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-6021\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-6052\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in how GLib\u2019s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn\u2019t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-190 Integer Overflow or Wraparound\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.7\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-7425\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-8916\n<div class=\"csaf-accordion-content\">\n\nAllocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9230\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9231\n<div class=\"csaf-accordion-content\">\n\nIssue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is possible to add support for such certificates via a custom provider, coupled with the fact that in such a custom provider context the private key may be recoverable via remote timing measurements, we consider this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as SM2 is not an approved algorithm.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-385 Covert Timing Channel\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9232\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9820\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-121 Stack-based Buffer Overflow\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-14831\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-407 Inefficient Algorithmic Complexity\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-23143\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. When I ran the repro [0] and waited a few seconds, I observed two LOCKDEP splats: a warning immediately followed by a null-ptr-deref. [1] Reproduction Steps: 1) Mount CIFS 2) Add an iptables rule to drop incoming FIN packets for CIFS 3) Unmount CIFS 4) Unload the CIFS module 5) Remove the iptables rule At step 3), the CIFS module calls sock_release() for the underlying TCP socket, and it returns quickly. However, the socket remains in FIN_WAIT_1 because incoming FIN packets are dropped. At this point, the module's refcnt is 0 while the socket is still alive, so the following rmmod command succeeds. # ss -tan State Recv-Q Send-Q Local Address:Port Peer Address:Port FIN-WAIT-1 0 477 10.0.2.15:51062 10.0.0.137:445 # lsmod | grep cifs cifs 1159168 0 This highlights a discrepancy between the lifetime of the CIFS module and the underlying TCP socket. Even after CIFS calls sock_release() and it returns, the TCP socket does not die immediately in order to close the connection gracefully. While this is generally fine, it causes an issue with LOCKDEP because CIFS assigns a different lock class to the TCP socket's sk->sk_lock using sock_lock_init_class_and_name(). Once an incoming packet is processed for the socket or a timer fires, sk->sk_lock is acquired. Then, LOCKDEP checks the lock context in check_wait_context(), where hlock_class() is called to retrieve the lock class. However, since the module has already been unloaded, hlock_class() logs a warning and returns NULL, triggering the null-ptr-deref. If LOCKDEP is enabled, we must ensure that a module calling sock_lock_init_class_and_name() (CIFS, NFS, etc) cannot be unloaded while such a socket is still alive to prevent this issue. Let's hold the module reference in sock_lock_init_class_and_name() and release it when the socket is freed in sk_prot_free(). Note that sock_lock_init() clears sk->sk_owner for svc_create_socket() that calls sock_lock_init_class_and_name() for a listening socket, which clones a socket by sk_clone_lock() without GFP_ZERO. [0]: CIFS_SERVER=\"10.0.0.137\" CIFS_PATH=\"//${CIFS_SERVER}/Users/Administrator/Desktop/CIFS_TEST\" DEV=\"enp0s3\" CRED=\"/root/WindowsCredential.txt\" MNT=$(mktemp -d /tmp/XXXXXX) mount -t cifs ${CIFS_PATH} ${MNT} -o vers=3.0,credentials=${CRED},cache=none,echo_interval=1 iptables -A INPUT -s ${CIFS_SERVER} -j DROP for i in $(seq 10); do umount ${MNT} rmmod cifs sleep 1 done rm -r ${MNT} iptables -D INPUT -s ${CIFS_SERVER} -j DROP [1]: DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 10 PID: 0 at kernel/locking/lockdep.c:234 hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223) Modules linked in: cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs] CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Not tainted 6.14.0 #36 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223) ... Call Trace: __lock_acquire (kernel/locking/lockdep.c:4853 kernel/locking/lockdep.c:5178) lock_acquire (kernel/locking/lockdep.c:469 kernel/locking/lockdep.c:5853 kernel/locking/lockdep.c:5816) _raw_spin_lock_nested (kernel/locking/spinlock.c:379) tcp_v4_rcv (./include/linux/skbuff.h:1678 ./include/net/tcp.h:2547 net/ipv4/tcp_ipv4.c:2350) ... BUG: kernel NULL pointer dereference, address: 00000000000000c4 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Tainted: G W 6.14.0 #36 Tainted: [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__lock_acquire (kernel/ ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-23160\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization On Mediatek devices with a system companion processor (SCP) the mtk_scp structure has to be removed explicitly to avoid a resource leak. Free the structure in case the allocation of the firmware structure fails during the firmware initialization.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-31257\n<div class=\"csaf-accordion-content\">\n\nThis issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-37931\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: adjust subpage bit start based on sectorsize When running machines with 64k page size and a 16k nodesize we started seeing tree log corruption in production. This turned out to be because we were not writing out dirty blocks sometimes, so this in fact affects all metadata writes. When writing out a subpage EB we scan the subpage bitmap for a dirty range. If the range isn't dirty we do bit_start++; to move onto the next bit. The problem is the bitmap is based on the number of sectors that an EB has. So in this case, we have a 64k pagesize, 16k nodesize, but a 4k sectorsize. This means our bitmap is 4 bits for every node. With a 64k page size we end up with 4 nodes per page. To make this easier this is how everything looks [0 16k 32k 48k ] logical address [0 4 8 12 ] radix tree offset [ 64k page ] folio [ 16k eb ][ 16k eb ][ 16k eb ][ 16k eb ] extent buffers [ | | | | | | | | | | | | | | | | ] bitmap Now we use all of our addressing based on fs_info->sectorsize_bits, so as you can see the above our 16k eb->start turns into radix entry 4. When we find a dirty range for our eb, we correctly do bit_start += sectors_per_node, because if we start at bit 0, the next bit for the next eb is 4, to correspond to eb->start 16k. However if our range is clean, we will do bit_start++, which will now put us offset from our radix tree entries. In our case, assume that the first time we check the bitmap the block is not dirty, we increment bit_start so now it == 1, and then we loop around and check again. This time it is dirty, and we go to find that start using the following equation start = folio_start + bit_start * fs_info->sectorsize; so in the case above, eb->start 0 is now dirty, and we calculate start as 0 + 1 * fs_info->sectorsize = 4096 4096 >> 12 = 1 Now we're looking up the radix tree for 1, and we won't find an eb. What's worse is now we're using bit_start == 1, so we do bit_start += sectors_per_node, which is now 5. If that eb is dirty we will run into the same thing, we will look at an offset that is not populated in the radix tree, and now we're skipping the writeout of dirty extent buffers. The best fix for this is to not use sectorsize_bits to address nodes, but that's a larger change. Since this is a fs corruption problem fix it simply by always using sectors_per_node to increment the start bit.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-37968\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: light: opt3001: fix deadlock due to concurrent flag access The threaded IRQ function in this driver is reading the flag twice: once to lock a mutex and once to unlock it. Even though the code setting the flag is designed to prevent it, there are subtle cases where the flag could be true at the mutex_lock stage and false at the mutex_unlock stage. This results in the mutex not being unlocked, resulting in a deadlock. Fix it by making the opt3001_irq() code generally more robust, reading the flag into a variable and using the variable value at both stages.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38322\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Hardware name: Dell Inc. Precision 9660/0VJ762 RIP: 0010:native_read_pmc+0x7/0x40 Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP: 000:fffb03100273de8 EFLAGS: 00010046 .... Call Trace: icl_update_topdown_event+0x165/0x190 ? ktime_get+0x38/0xd0 intel_pmu_read_event+0xf9/0x210 __perf_event_read+0xf9/0x210 CPUs 16-23 are E-core CPUs that don't support the perf metrics feature. The icl_update_topdown_event() should not be invoked on these CPUs. It's a regression of commit: f9bdf1f95339 (\"perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read\") The bug introduced by that commit is that the is_topdown_event() function is mistakenly used to replace the is_topdown_count() call to check if the topdown functions for the perf metrics feature should be invoked. Fix it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38347\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on ino and xnid syzbot reported a f2fs bug as below: INFO: task syz-executor140:5308 blocked for more than 143 seconds. Not tainted 6.14.0-rc7-syzkaller-00069-g81e4f8d68c66 #0 \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message. task:syz-executor140 state:D stack:24016 pid:5308 tgid:5308 ppid:5306 task_flags:0x400140 flags:0x00000006 Call Trace: context_switch kernel/sched/core.c:5378 [inline] __schedule+0x190e/0x4c90 kernel/sched/core.c:6765 __schedule_loop kernel/sched/core.c:6842 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6857 io_schedule+0x8d/0x110 kernel/sched/core.c:7690 folio_wait_bit_common+0x839/0xee0 mm/filemap.c:1317 __folio_lock mm/filemap.c:1664 [inline] folio_lock include/linux/pagemap.h:1163 [inline] __filemap_get_folio+0x147/0xb40 mm/filemap.c:1917 pagecache_get_page+0x2c/0x130 mm/folio-compat.c:87 find_get_page_flags include/linux/pagemap.h:842 [inline] f2fs_grab_cache_page+0x2b/0x320 fs/f2fs/f2fs.h:2776 __get_node_page+0x131/0x11b0 fs/f2fs/node.c:1463 read_xattr_block+0xfb/0x190 fs/f2fs/xattr.c:306 lookup_all_xattrs fs/f2fs/xattr.c:355 [inline] f2fs_getxattr+0x676/0xf70 fs/f2fs/xattr.c:533 __f2fs_get_acl+0x52/0x870 fs/f2fs/acl.c:179 f2fs_acl_create fs/f2fs/acl.c:375 [inline] f2fs_init_acl+0xd7/0x9b0 fs/f2fs/acl.c:418 f2fs_init_inode_metadata+0xa0f/0x1050 fs/f2fs/dir.c:539 f2fs_add_inline_entry+0x448/0x860 fs/f2fs/inline.c:666 f2fs_add_dentry+0xba/0x1e0 fs/f2fs/dir.c:765 f2fs_do_add_link+0x28c/0x3a0 fs/f2fs/dir.c:808 f2fs_add_link fs/f2fs/f2fs.h:3616 [inline] f2fs_mknod+0x2e8/0x5b0 fs/f2fs/namei.c:766 vfs_mknod+0x36d/0x3b0 fs/namei.c:4191 unix_bind_bsd net/unix/af_unix.c:1286 [inline] unix_bind+0x563/0xe30 net/unix/af_unix.c:1379 __sys_bind_socket net/socket.c:1817 [inline] __sys_bind+0x1e4/0x290 net/socket.c:1848 __do_sys_bind net/socket.c:1853 [inline] __se_sys_bind net/socket.c:1851 [inline] __x64_sys_bind+0x7a/0x90 net/socket.c:1851 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Let's dump and check metadata of corrupted inode, it shows its xattr_nid is the same to its i_ino. dump.f2fs -i 3 chaseyu.img.raw i_xattr_nid [0x 3 : 3] So that, during mknod in the corrupted directory, it tries to get and lock inode page twice, result in deadlock. - f2fs_mknod - f2fs_add_inline_entry - f2fs_get_inode_page --- lock dir's inode page - f2fs_init_acl - f2fs_acl_create(dir,..) - __f2fs_get_acl - f2fs_getxattr - lookup_all_xattrs - __get_node_page --- try to lock dir's inode page In order to fix this, let's add sanity check on ino and xnid.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38491\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mptcp: make fallback action and fallback decision atomic Syzkaller reported the following splat: WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 check_fully_established net/mptcp/options.c:982 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Modules linked in: CPU: 1 UID: 0 PID: 7704 Comm: syz.3.1419 Not tainted 6.16.0-rc3-gbd5ce2324dba #20 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] RIP: 0010:mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] RIP: 0010:check_fully_established net/mptcp/options.c:982 [inline] RIP: 0010:mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Code: 24 18 e8 bb 2a 00 fd e9 1b df ff ff e8 b1 21 0f 00 e8 ec 5f c4 fc 44 0f b7 ac 24 b0 00 00 00 e9 54 f1 ff ff e8 d9 5f c4 fc 90 <0f> 0b 90 e9 b8 f4 ff ff e8 8b 2a 00 fd e9 8d e6 ff ff e8 81 2a 00 RSP: 0018:ffff8880a3f08448 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880180a8000 RCX: ffffffff84afcf45 RDX: ffff888090223700 RSI: ffffffff84afdaa7 RDI: 0000000000000001 RBP: ffff888017955780 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880180a8910 R14: ffff8880a3e9d058 R15: 0000000000000000 FS: 00005555791b8500(0000) GS:ffff88811c495000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c2800b7 CR3: 0000000058e44000 CR4: 0000000000350ef0 Call Trace: tcp_reset+0x26f/0x2b0 net/ipv4/tcp_input.c:4432 tcp_validate_incoming+0x1057/0x1b60 net/ipv4/tcp_input.c:5975 tcp_rcv_established+0x5b5/0x21f0 net/ipv4/tcp_input.c:6166 tcp_v4_do_rcv+0x5dc/0xa70 net/ipv4/tcp_ipv4.c:1925 tcp_v4_rcv+0x3473/0x44a0 net/ipv4/tcp_ipv4.c:2363 ip_protocol_deliver_rcu+0xba/0x480 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2f1/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_local_deliver+0x1be/0x560 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:469 [inline] ip_rcv_finish net/ipv4/ip_input.c:447 [inline] NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_rcv+0x514/0x810 net/ipv4/ip_input.c:567 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5975 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6088 process_backlog+0x301/0x1360 net/core/dev.c:6440 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7453 napi_poll net/core/dev.c:7517 [inline] net_rx_action+0xb44/0x1010 net/core/dev.c:7644 handle_softirqs+0x1d0/0x770 kernel/softirq.c:579 do_softirq+0x3f/0x90 kernel/softirq.c:480 __local_bh_enable_ip+0xed/0x110 kernel/softirq.c:407 local_bh_enable include/linux/bottom_half.h:33 [inline] inet_csk_listen_stop+0x2c5/0x1070 net/ipv4/inet_connection_sock.c:1524 mptcp_check_listen_stop.part.0+0x1cc/0x220 net/mptcp/protocol.c:2985 mptcp_check_listen_stop net/mptcp/mib.h:118 [inline] __mptcp_close+0x9b9/0xbd0 net/mptcp/protocol.c:3000 mptcp_close+0x2f/0x140 net/mptcp/protocol.c:3066 inet_release+0xed/0x200 net/ipv4/af_inet.c:435 inet6_release+0x4f/0x70 net/ipv6/af_inet6.c:487 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x402/0xb70 fs/file_table.c:465 task_work_run+0x150/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xd4 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38502\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: bpf: Fix oob access in cgroup local storage Lonial reported that an out-of-bounds access in cgroup local storage can be crafted via tail calls. Given two programs each utilizing a cgroup local storage with a different value size, and one program doing a tail call into the other. The verifier will validate each of the indivial programs just fine. However, in the runtime context the bpf_cg_run_ctx holds an bpf_prog_array_item which contains the BPF program as well as any cgroup local storage flavor the program uses. Helpers such as bpf_get_local_storage() pick this up from the runtime context: ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx); storage = ctx->prog_item->cgroup_storage[stype]; if (stype == BPF_CGROUP_STORAGE_SHARED) ptr = &READ_ONCE(storage->buf)->data[0]; else ptr = this_cpu_ptr(storage->percpu_buf); For the second program which was called from the originally attached one, this means bpf_get_local_storage() will pick up the former program's map, not its own. With mismatching sizes, this can result in an unintended out-of-bounds access. To fix this issue, we need to extend bpf_map_owner with an array of storage_cookie[] to match on i) the exact maps from the original program if the second program was using bpf_get_local_storage(), or ii) allow the tail call combination if the second program was not using any of the cgroup local storage maps.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38552\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between subflow fail and subflow creation We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are just harder to trigger. The solution is similar. Use a separate flag to track the condition 'socket state prevent any additional subflow creation' protected by the fallback lock. The socket fallback makes such flag true, and also receiving or sending an MP_FAIL option. The field 'allow_infinite_fallback' is now always touched under the relevant lock, we can drop the ONCE annotation on write.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38614\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the depth of the resulting tree for two reasons: - They don't look upwards in the tree. - If there are multiple downwards paths of different lengths, only one of the paths is actually considered for the depth check since commit 28d82dc1c4ed (\"epoll: limit paths\"). Essentially, the current recursion depth check in ep_loop_check_proc() just serves to prevent it from recursing too deeply while checking for loops. A more thorough check is done in reverse_path_check() after the new graph edge has already been created; this checks, among other things, that no paths going upwards from any non-epoll file with a length of more than 5 edges exist. However, this check does not apply to non-epoll files. As a result, it is possible to recurse to a depth of at least roughly 500, tested on v6.15. (I am unsure if deeper recursion is possible; and this may have changed with commit 8c44dac8add7 (\"eventpoll: Fix priority inversion problem\").) To fix it: 1. In ep_loop_check_proc(), note the subtree depth of each visited node, and use subtree depths for the total depth calculation even when a subtree has already been visited. 2. Add ep_get_upwards_depth_proc() for similarly determining the maximum depth of an upwards walk. 3. In ep_loop_check(), use these values to limit the total path length between epoll nodes to EP_MAX_NESTS edges.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-674 Uncontrolled Recursion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38670\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() `cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change to different stacks along with the Shadow Call Stack if it is enabled. Those two stack changes cannot be done atomically and both functions can be interrupted by SErrors or Debug Exceptions which, though unlikely, is very much broken : if interrupted, we can end up with mismatched stacks and Shadow Call Stack leading to clobbered stacks. In `cpu_switch_to()`, it can happen when SP_EL0 points to the new task, but x18 stills points to the old task's SCS. When the interrupt handler tries to save the task's SCS pointer, it will save the old task SCS pointer (x18) into the new task struct (pointed to by SP_EL0), clobbering it. In `call_on_irq_stack()`, it can happen when switching from the task stack to the IRQ stack and when switching back. In both cases, we can be interrupted when the SCS pointer points to the IRQ SCS, but SP points to the task stack. The nested interrupt handler pushes its return addresses on the IRQ SCS. It then detects that SP points to the task stack, calls `call_on_irq_stack()` and clobbers the task SCS pointer with the IRQ SCS pointer, which it will also use ! This leads to tasks returning to addresses on the wrong SCS, or even on the IRQ SCS, triggering kernel panics via CONFIG_VMAP_STACK or FPAC if enabled. This is possible on a default config, but unlikely. However, when enabling CONFIG_ARM64_PSEUDO_NMI, DAIF is unmasked and instead the GIC is responsible for filtering what interrupts the CPU should receive based on priority. Given the goal of emulating NMIs, pseudo-NMIs can be received by the CPU even in `cpu_switch_to()` and `call_on_irq_stack()`, possibly *very* frequently depending on the system configuration and workload, leading to unpredictable kernel panics. Completely mask DAIF in `cpu_switch_to()` and restore it when returning. Do the same in `call_on_irq_stack()`, but restore and mask around the branch. Mask DAIF even if CONFIG_SHADOW_CALL_STACK is not enabled for consistency of behaviour between all configurations. Introduce and use an assembly macro for saving and masking DAIF, as the existing one saves but only masks IF.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38676\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iommu/amd: Avoid stack buffer overflow from kernel cmdline While the kernel command line is considered trusted in most environments, avoid writing 1 byte past the end of \"acpiid\" if the \"str\" argument is maximum length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-805 Buffer Access with Incorrect Length Value\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38677\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-boundary access in dnode page As Jiaming Zhang reported: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x1c1/0x2a0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x17e/0x800 mm/kasan/report.c:480 kasan_report+0x147/0x180 mm/kasan/report.c:593 data_blkaddr fs/f2fs/f2fs.h:3053 [inline] f2fs_data_blkaddr fs/f2fs/f2fs.h:3058 [inline] f2fs_get_dnode_of_data+0x1a09/0x1c40 fs/f2fs/node.c:855 f2fs_reserve_block+0x53/0x310 fs/f2fs/data.c:1195 prepare_write_begin fs/f2fs/data.c:3395 [inline] f2fs_write_begin+0xf39/0x2190 fs/f2fs/data.c:3594 generic_perform_write+0x2c7/0x910 mm/filemap.c:4112 f2fs_buffered_write_iter fs/f2fs/file.c:4988 [inline] f2fs_file_write_iter+0x1ec8/0x2410 fs/f2fs/file.c:5216 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x546/0xa90 fs/read_write.c:686 ksys_write+0x149/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x3d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is in the corrupted image, there is a dnode has the same node id w/ its inode, so during f2fs_get_dnode_of_data(), it tries to access block address in dnode at offset 934, however it parses the dnode as inode node, so that get_dnode_addr() returns 360, then it tries to access page address from 360 + 934 * 4 = 4096 w/ 4 bytes. To fix this issue, let's add sanity check for node id of all direct nodes during f2fs_get_dnode_of_data().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38679\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: Fix OOB read due to missing payload bound check Currently, The event_seq_changed() handler processes a variable number of properties sent by the firmware. The number of properties is indicated by the firmware and used to iterate over the payload. However, the payload size is not being validated against the actual message length. This can lead to out-of-bounds memory access if the firmware provides a property count that exceeds the data available in the payload. Such a condition can result in kernel crashes or potential information leaks if memory beyond the buffer is accessed. Fix this by properly validating the remaining size of the payload before each property access and updating bounds accordingly as properties are parsed. This ensures that property parsing is safely bounded within the received message buffer and protects against malformed or malicious firmware behavior.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38680\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() The buffer length check before calling uvc_parse_format() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 bytes. This can lead to an out-of-bounds read if the buffer has exactly 3 bytes. Fix it by checking that the buffer has at least 4 bytes in uvc_parse_format().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38681\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() Memory hot remove unmaps and tears down various kernel page table regions as required. The ptdump code can race with concurrent modifications of the kernel page tables. When leaf entries are modified concurrently, the dump code may log stale or inconsistent information for a VA range, but this is otherwise not harmful. But when intermediate levels of kernel page table are freed, the dump code will continue to use memory that has been freed and potentially reallocated for another purpose. In such cases, the ptdump code may dereference bogus addresses, leading to a number of potential problems. To avoid the above mentioned race condition, platforms such as arm64, riscv and s390 take memory hotplug lock, while dumping kernel page table via the sysfs interface /sys/kernel/debug/kernel_page_tables. Similar race condition exists while checking for pages that might have been marked W+X via /sys/kernel/debug/kernel_page_tables/check_wx_pages which in turn calls ptdump_check_wx(). Instead of solving this race condition again, let's just move the memory hotplug lock inside generic ptdump_check_wx() which will benefit both the scenarios. Drop get_online_mems() and put_online_mems() combination from all existing platform ptdump code paths.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-366 Race Condition within a Thread\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38683\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, default_device_exit_batch() >> default_device_exit_net() is called. When netvsc NIC is moved back and registered to the default namespace, it automatically brings VF NIC back to the default namespace. This will cause the default_device_exit_net() >> for_each_netdev_safe loop unable to detect the list end, and hit NULL ptr: [ 231.449420] mana 7870:00:00.0 enP30832s1: Moved VF to namespace with: eth0 [ 231.449656] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 231.450246] #PF: supervisor read access in kernel mode [ 231.450579] #PF: error_code(0x0000) - not-present page [ 231.450916] PGD 17b8a8067 P4D 0 [ 231.451163] Oops: Oops: 0000 [#1] SMP NOPTI [ 231.451450] CPU: 82 UID: 0 PID: 1394 Comm: kworker/u768:1 Not tainted 6.16.0-rc4+ #3 VOLUNTARY [ 231.452042] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/21/2024 [ 231.452692] Workqueue: netns cleanup_net [ 231.452947] RIP: 0010:default_device_exit_batch+0x16c/0x3f0 [ 231.453326] Code: c0 0c f5 b3 e8 d5 db fe ff 48 85 c0 74 15 48 c7 c2 f8 fd ca b2 be 10 00 00 00 48 8d 7d c0 e8 7b 77 25 00 49 8b 86 28 01 00 00 <48> 8b 50 10 4c 8b 2a 4c 8d 62 f0 49 83 ed 10 4c 39 e0 0f 84 d6 00 [ 231.454294] RSP: 0018:ff75fc7c9bf9fd00 EFLAGS: 00010246 [ 231.454610] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 61c8864680b583eb [ 231.455094] RDX: ff1fa9f71462d800 RSI: ff75fc7c9bf9fd38 RDI: 0000000030766564 [ 231.455686] RBP: ff75fc7c9bf9fd78 R08: 0000000000000000 R09: 0000000000000000 [ 231.456126] R10: 0000000000000001 R11: 0000000000000004 R12: ff1fa9f70088e340 [ 231.456621] R13: ff1fa9f70088e340 R14: ffffffffb3f50c20 R15: ff1fa9f7103e6340 [ 231.457161] FS: 0000000000000000(0000) GS:ff1faa6783a08000(0000) knlGS:0000000000000000 [ 231.457707] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 231.458031] CR2: 0000000000000010 CR3: 0000000179ab2006 CR4: 0000000000b73ef0 [ 231.458434] Call Trace: [ 231.458600] [ 231.458777] ops_undo_list+0x100/0x220 [ 231.459015] cleanup_net+0x1b8/0x300 [ 231.459285] process_one_work+0x184/0x340 To fix it, move the ns change to a workqueue, and take rtnl_lock to avoid changing the netdev list when default_device_exit_net() is using it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-820 Missing Synchronization\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.2\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38684\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify() after recent changes from Lion [2]. The problem is: in ets_qdisc_change() we purge unused DWRR queues; the value of 'q->nbands' is the new one, and the cleanup should be done with the old one. The problem is here since my first attempts to fix ets_qdisc_change(), but it surfaced again after the recent qdisc len accounting fixes. Fix it purging idle DWRR queues before assigning a new value of 'q->nbands', so that all purge operations find a consistent configuration: - old 'q->nbands' because it's needed by ets_class_find() - old 'q->nstrict' because it's needed by ets_class_is_strict() BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 62 UID: 0 PID: 39457 Comm: tc Kdump: loaded Not tainted 6.12.0-116.el10.x86_64 #1 PREEMPT(voluntary) Hardware name: Dell Inc. PowerEdge R640/06DKY5, BIOS 2.12.2 07/09/2021 RIP: 0010:__list_del_entry_valid_or_report+0x4/0x80 Code: ff 4c 39 c7 0f 84 39 19 8e ff b8 01 00 00 00 c3 cc cc cc cc 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <48> 8b 17 48 8b 4f 08 48 85 d2 0f 84 56 19 8e ff 48 85 c9 0f 84 ab RSP: 0018:ffffba186009f400 EFLAGS: 00010202 RAX: 00000000000000d6 RBX: 0000000000000000 RCX: 0000000000000004 RDX: ffff9f0fa29b69c0 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffffffc12c2400 R08: 0000000000000008 R09: 0000000000000004 R10: ffffffffffffffff R11: 0000000000000004 R12: 0000000000000000 R13: ffff9f0f8cfe0000 R14: 0000000000100005 R15: 0000000000000000 FS: 00007f2154f37480(0000) GS:ffff9f269c1c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001530be001 CR4: 00000000007726f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ets_class_qlen_notify+0x65/0x90 [sch_ets] qdisc_tree_reduce_backlog+0x74/0x110 ets_qdisc_change+0x630/0xa40 [sch_ets] __tc_modify_qdisc.constprop.0+0x216/0x7f0 tc_modify_qdisc+0x7c/0x120 rtnetlink_rcv_msg+0x145/0x3f0 netlink_rcv_skb+0x53/0x100 netlink_unicast+0x245/0x390 netlink_sendmsg+0x21b/0x470 ____sys_sendmsg+0x39d/0x3d0 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xd0 do_syscall_64+0x7d/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f2155114084 Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 25 f0 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 RSP: 002b:00007fff1fd7a988 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000560ec063e5e0 RCX: 00007f2155114084 RDX: 0000000000000000 RSI: 00007fff1fd7a9f0 RDI: 0000000000000003 RBP: 00007fff1fd7aa60 R08: 0000000000000010 R09: 000000000000003f R10: 0000560ee9b3a010 R11: 0000000000000202 R12: 00007fff1fd7aae0 R13: 000000006891ccde R14: 0000560ec063e5e0 R15: 00007fff1fd7aad0 [1] https://lore.kernel.org/netdev/e08c7f4a6882f260011909a868311c6e9b54f3e4.1639153474.git.dcaratti@redhat.com/ [2] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.2\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38685\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible. As part of mapping it has to do resize of console according to frame buffer info. if this resize fails and returns from vc_do_resize() and continues further. At this point console and new frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the screen at later stages where vc_data is related to previous frame buffer and frame buffer info and display vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fast_imageblit(). This bheviour is excepted only when fg_console is equal to requested console which is a visible console and updates screen with invalid struct references in fbcon_putcs().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38687\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the wait_queue_head inside of it. This can cause a use-after-free when the poll entries are later triggered or removed, as the memory for the wait_queue_head has been freed. We need to check there are no tasks queued on any of the subdevices' wait queues before allowing the device to be detached by the `COMEDI_DEVCONFIG` ioctl. Tasks will read-lock `dev->attach_lock` before adding themselves to the subdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl handler by write-locking `dev->attach_lock` before checking that all of the subdevices are safe to be deleted. This includes testing for any sleepers on the subdevices' wait queues. It remains locked until the device has been detached. This requires the `comedi_device_detach()` function to be refactored slightly, moving the bulk of it into new function `comedi_device_detach_locked()`. Note that the refactor of `comedi_device_detach()` results in `comedi_device_cancel_all()` now being called while `dev->attach_lock` is write-locked, which wasn't the case previously, but that does not matter. Thanks to Jens Axboe for diagnosing the problem and co-developing this patch.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38691\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the \"layoutupdate_pages\" page array is initialized only after the retry loop. But ext_tree_free_commitdata() is called on every iteration and tries to put pages in the array, thus dereferencing uninitialized pointers. An additional problem is that there is no limit on the maximum possible buffer_size. When there are too many extents, the client may create a layoutcommit that is larger than the maximum possible RPC size accepted by the server. During testing, we observed two typical scenarios. First, one memory page for extents is enough when we work with small files, append data to the end of the file, or preallocate extents before writing. But when we fill a new large file without preallocating, the number of extents can be huge, and counting the number of written extents in ext_tree_encode_commit() does not help much. Since this number increases even more between unlocking and locking of ext_tree, the reallocated buffer may not be large enough again and again.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-908 Use of Uninitialized Resource\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38693\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar commit: commit 0ed554fd769a (\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38694\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar issue occurs when access msg[1].buf[0] and msg[1].buf[1]. Similar commit: commit 0ed554fd769a (\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38695\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the resultant cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() may occur before sli4_hba.hdwqs are allocated. This may result in a null pointer dereference when attempting to take the abts_io_buf_list_lock for the first hardware queue. Fix by adding a null ptr check on phba->sli4_hba.hdwq and early return because this situation means there must have been an error during port initialization.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38696\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stack_top() for tasks without ABI or vDSO Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL ABI pointer and crash. This can for example happen when using kunit: mips_stack_top+0x28/0xc0 arch_pick_mmap_layout+0x190/0x220 kunit_vm_mmap_init+0xf8/0x138 __kunit_add_resource+0x40/0xa8 kunit_vm_mmap+0x88/0xd8 usercopy_test_init+0xb8/0x240 kunit_try_run_case+0x5c/0x1a8 kunit_generic_run_threadfn_adapter+0x28/0x50 kthread+0x118/0x240 ret_from_kernel_thread+0x14/0x1c Only dereference the ABI point if it is set. The GIC page is also included as it is specific to the vDSO. Also move the randomization adjustment into the same conditional.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38697\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: upper bound check of tree index in dbAllocAG When computing the tree index in dbAllocAG, we never check if we are out of bounds realative to the size of the stree. This could happen in a scenario where the filesystem metadata are corrupted.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38698\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: Regular file corruption check The reproducer builds a corrupted file on disk with a negative i_size value. Add a check when opening this file to avoid subsequent operation failures.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38699\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix When the bfad_im_probe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfad->im to NULL. Subsequently, during driver uninstallation, when the state machine enters the bfad_sm_stopping state and calls the bfad_im_probe_undo() function, it attempts to free the memory pointed to by bfad->im again, thereby triggering a double-free vulnerability. Set bfad->im to NULL if probing fails.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-415 Double Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.4\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38700\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated In case of an ib_fast_reg_mr allocation failure during iSER setup, the machine hits a panic because iscsi_conn->dd_data is initialized unconditionally, even when no memory is allocated (dd_size == 0). This leads invalid pointer dereference during connection teardown. Fix by setting iscsi_conn->dd_data only if memory is actually allocated. Panic trace: ------------ iser: iser_create_fastreg_desc: Failed to allocate ib_fast_reg_mr err=-12 iser: iser_alloc_rx_descriptors: failed allocating rx descriptors / data buffers BUG: unable to handle page fault for address: fffffffffffffff8 RIP: 0010:swake_up_locked.part.5+0xa/0x40 Call Trace: complete+0x31/0x40 iscsi_iser_conn_stop+0x88/0xb0 [ib_iser] iscsi_stop_conn+0x66/0xc0 [scsi_transport_iscsi] iscsi_if_stop_conn+0x14a/0x150 [scsi_transport_iscsi] iscsi_if_rx+0x1135/0x1834 [scsi_transport_iscsi] ? netlink_lookup+0x12f/0x1b0 ? netlink_deliver_tap+0x2c/0x200 netlink_unicast+0x1ab/0x280 netlink_sendmsg+0x257/0x4f0 ? _copy_from_user+0x29/0x60 sock_sendmsg+0x5f/0x70\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38701\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missing the system.data extended attribute. Since this can happen due to a maiciouly fuzzed file system, we shouldn't BUG, but rather, report it as a corrupted file system. Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii ext4_create_inline_data() and ext4_inline_data_truncate().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-617 Reachable Assertion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38702\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer overflow in do_register_framebuffer() The current implementation may lead to buffer overflow when: 1. Unregistration creates NULL gaps in registered_fb[] 2. All array slots become occupied despite num_registered_fb < FB_MAX 3. The registration loop exceeds array bounds Add boundary check to prevent registered_fb[FB_MAX] access.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38706\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on the system. On module removal the soc_tplg_remove_link() would call snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored, no runtime was created.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38707\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for file name The length of the file name should be smaller than the directory entry size.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38708\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD tries to detect \"concurrent\" writes and handle write conflicts, so that even if you write to the same sector simultaneously on both nodes, they end up with the identical data once the writes are completed. In handling \"superseeded\" writes, we forgot a kref_get, resulting in a premature drbd_destroy_device and use after free, and further to kernel crashes with symptoms. Relevance: No one should use DRBD as a random data generator, and apparently all users of \"two-primaries\" handle concurrent writes correctly on layer up. That is cluster file systems use some distributed lock manager, and live migration in virtualization environments stops writes on one node before starting writes on the other node. Which means that other than for \"test cases\", this code path is never taken in real life. FYI, in DRBD 9, things are handled differently nowadays. We still detect \"write conflicts\", but no longer try to be smart about them. We decided to disconnect hard instead: upper layers must not submit concurrent writes. If they do, that's their fault.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38711\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb/server: avoid deadlock when linking with ReplaceIfExists If smb2_create_link() is called with ReplaceIfExists set and the name does exist then a deadlock will happen. ksmbd_vfs_kern_path_locked() will return with success and the parent directory will be locked. ksmbd_vfs_remove_file() will then remove the file. ksmbd_vfs_link() will then be called while the parent is still locked. It will try to lock the same parent and will deadlock. This patch moves the ksmbd_vfs_kern_path_unlock() call to *before* ksmbd_vfs_link() and then simplifies the code, removing the file_present flag variable.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38712\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplus_fill_super() assumes that the attributes file is not yet created, which later results in hitting BUG_ON() when hfsplus_create_attributes_file() is called. Replace this BUG_ON() with -EIO error with a message to suggest running fsck tool.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38713\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc(): [ 667.121659][ T9805] ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][ T9805] [ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0 [ 667.124911][ T9805] print_report+0xd0/0x660 [ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610 [ 667.124928][ T9805] ? __phys_addr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124942][ T9805] kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][ T9805] hfsplus_uni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360 [ 667.124974][ T9805] hfsplus_readdir+0x845/0xfc0 [ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10 [ 667.124994][ T9805] ? stack_trace_save+0x8e/0xc0 [ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125015][ T9805] ? trace_lock_acquire+0x85/0xd0 [ 667.125022][ T9805] ? lock_acquire+0x30/0x80 [ 667.125029][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10 [ 667.125058][ T9805] ? apparmor_file_permission+0x239/0x3e0 [ 667.125069][ T9805] iterate_dir+0x296/0xb20 [ 667.125076][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10 [ 667.125091][ T9805] ? __x64_sys_openat+0x141/0x200 [ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10 [ 667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0 [ 667.125143][ T9805] do_syscall_64+0xc9/0x480 [ 667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] [ 667.125210][ T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasan_save_stack+0x20/0x40 [ 667.146352][ T9805] kasan_save_track+0x14/0x30 [ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0 [ 667.147065][ T9805] __kmalloc_noprof+0x205/0x550 [ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0 [ 667.147813][ T9805] hfsplus_readdir+0x220/0xfc0 [ 667.148174][ T9805] iterate_dir+0x296/0xb20 [ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805] do_syscall_64+0xc9/0x480 [ 667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.1 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38714\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() The hfsplus_bnode_read() method can trigger the issue: [ 174.852007][ T9784] ================================================================== [ 174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360 [ 174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784 [ 174.854059][ T9784] [ 174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full) [ 174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.854286][ T9784] Call Trace: [ 174.854289][ T9784] [ 174.854292][ T9784] dump_stack_lvl+0x10e/0x1f0 [ 174.854305][ T9784] print_report+0xd0/0x660 [ 174.854315][ T9784] ? __virt_addr_valid+0x81/0x610 [ 174.854323][ T9784] ? __phys_addr+0xe8/0x180 [ 174.854330][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854337][ T9784] kasan_report+0xc6/0x100 [ 174.854346][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854354][ T9784] hfsplus_bnode_read+0x2f4/0x360 [ 174.854362][ T9784] hfsplus_bnode_dump+0x2ec/0x380 [ 174.854370][ T9784] ? __pfx_hfsplus_bnode_dump+0x10/0x10 [ 174.854377][ T9784] ? hfsplus_bnode_write_u16+0x83/0xb0 [ 174.854385][ T9784] ? srcu_gp_start+0xd0/0x310 [ 174.854393][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854402][ T9784] hfsplus_brec_remove+0x3d2/0x4e0 [ 174.854411][ T9784] __hfsplus_delete_attr+0x290/0x3a0 [ 174.854419][ T9784] ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10 [ 174.854427][ T9784] ? __pfx___hfsplus_delete_attr+0x10/0x10 [ 174.854436][ T9784] ? __asan_memset+0x23/0x50 [ 174.854450][ T9784] hfsplus_delete_all_attrs+0x262/0x320 [ 174.854459][ T9784] ? __pfx_hfsplus_delete_all_attrs+0x10/0x10 [ 174.854469][ T9784] ? rcu_is_watching+0x12/0xc0 [ 174.854476][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854483][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.854493][ T9784] ? __pfx_hfsplus_delete_cat+0x10/0x10 [ 174.854507][ T9784] hfsplus_unlink+0x1ca/0x7c0 [ 174.854516][ T9784] ? __pfx_hfsplus_unlink+0x10/0x10 [ 174.854525][ T9784] ? down_write+0x148/0x200 [ 174.854532][ T9784] ? __pfx_down_write+0x10/0x10 [ 174.854540][ T9784] vfs_unlink+0x2fe/0x9b0 [ 174.854549][ T9784] do_unlinkat+0x490/0x670 [ 174.854557][ T9784] ? __pfx_do_unlinkat+0x10/0x10 [ 174.854565][ T9784] ? __might_fault+0xbc/0x130 [ 174.854576][ T9784] ? getname_flags.part.0+0x1c5/0x550 [ 174.854584][ T9784] __x64_sys_unlink+0xc5/0x110 [ 174.854592][ T9784] do_syscall_64+0xc9/0x480 [ 174.854600][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167 [ 174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08 [ 174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167 [ 174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50 [ 174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40 [ 174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0 [ 174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 174.854658][ T9784] [ 174.854661][ T9784] [ 174.879281][ T9784] Allocated by task 9784: [ 174.879664][ T9784] kasan_save_stack+0x20/0x40 [ 174.880082][ T9784] kasan_save_track+0x14/0x30 [ 174.880500][ T9784] __kasan_kmalloc+0xaa/0xb0 [ 174.880908][ T9784] __kmalloc_noprof+0x205/0x550 [ 174.881337][ T9784] __hfs_bnode_create+0x107/0x890 [ 174.881779][ T9784] hfsplus_bnode_find+0x2d0/0xd10 [ 174.882222][ T9784] hfsplus_brec_find+0x2b0/0x520 [ 174.882659][ T9784] hfsplus_delete_all_attrs+0x23b/0x3 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38715\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfs: fix slab-out-of-bounds in hfs_bnode_read() This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(), hfs_bnode_copy(), and hfs_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38721\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone. This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0. This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever. This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list. One fix would to change this to: if (res < 0) { if (ct != last) nf_conntrack_get(&ct->ct_general); But this reference counting isn't needed in the first place. We can just store a cookie value instead. A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-772 Missing Release of Resource after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38723\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix jump offset calculation in tailcall The extra pass of bpf_int_jit_compile() skips JIT context initialization which essentially skips offset calculation leaving out_offset = -1, so the jmp_offset in emit_bpf_tail_call is calculated by \"#define jmp_offset (out_offset - (cur_offset))\" is a negative number, which is wrong. The final generated assembly are as follow. 54: bgeu $a2, $t1, -8 # 0x0000004c 58: addi.d $a6, $s5, -1 5c: bltz $a6, -16 # 0x0000004c 60: alsl.d $t2, $a2, $a1, 0x3 64: ld.d $t2, $t2, 264 68: beq $t2, $zero, -28 # 0x0000004c Before apply this patch, the follow test case will reveal soft lock issues. cd tools/testing/selftests/bpf/ ./test_progs --allow=tailcalls/tailcall_bpf2bpf_1 dmesg: watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [test_progs:25056]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38724\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38725\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: add phy_mask for ax88772 mdio bus Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00 ~ 0x1f. DLink DUB-E100 H/W Ver B1 is such a device. However, only one main phy device will bind to net phy driver. This is creating issue during system suspend/resume since phy_polling_mode() in phy_state_machine() will directly deference member of phydev->drv for non-main phy devices. Then NULL pointer dereference issue will occur. Due to only external phy or internal phy is necessary, add phy_mask for ax88772 mdio bus to workarnoud the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38727\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has: rmem < READ_ONCE(sk->sk_rcvbuf) to check if the just increased rmem value fits into the socket's receive buffer. If not, it proceeds and tries to wait for the memory under: rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf) The checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is equal to sk->sk_rcvbuf. Thus the function neither successfully accepts these conditions, nor manages to reschedule the task - and is called in retry loop for indefinite time which is caught as: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 0-....: (25999 ticks this GP) idle=ef2/1/0x4000000000000000 softirq=262269/262269 fqs=6212 (t=26000 jiffies g=230833 q=259957) NMI backtrace for cpu 0 CPU: 0 PID: 22 Comm: kauditd Not tainted 5.10.240 #68 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc42 04/01/2014 Call Trace: dump_stack lib/dump_stack.c:120 nmi_cpu_backtrace.cold lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace lib/nmi_backtrace.c:62 rcu_dump_cpu_stacks kernel/rcu/tree_stall.h:335 rcu_sched_clock_irq.cold kernel/rcu/tree.c:2590 update_process_times kernel/time/timer.c:1953 tick_sched_handle kernel/time/tick-sched.c:227 tick_sched_timer kernel/time/tick-sched.c:1399 __hrtimer_run_queues kernel/time/hrtimer.c:1652 hrtimer_interrupt kernel/time/hrtimer.c:1717 __sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1113 asm_call_irq_on_stack arch/x86/entry/entry_64.S:808 netlink_attachskb net/netlink/af_netlink.c:1234 netlink_unicast net/netlink/af_netlink.c:1349 kauditd_send_queue kernel/audit.c:776 kauditd_thread kernel/audit.c:897 kthread kernel/kthread.c:328 ret_from_fork arch/x86/entry/entry_64.S:304 Restore the original behavior of the check which commit in Fixes accidentally missed when restructuring the code. Found by Linux Verification Center (linuxtesting.org).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38728\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below): BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827 CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38729\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38732\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't leak dst refcount for loopback packets recent patches to add a WARN() when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 [..] Call Trace: nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] .. This is because blamed commit forgot about loopback packets. Such packets already have a dst_entry attached, even at PRE_ROUTING stage. Instead of checking hook just check if the skb already has a route attached to it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-911 Improper Update of Reference Count\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.8\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38735\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: gve: prevent ethtool ops after shutdown A crash can occur if an ethtool operation is invoked after shutdown() is called. shutdown() is invoked during system shutdown to stop DMA operations without performing expensive deallocations. It is discouraged to unregister the netdev in this path, so the device may still be visible to userspace and kernel helpers. In gve, shutdown() tears down most internal data structures. If an ethtool operation is dispatched after shutdown(), it will dereference freed or NULL pointers, leading to a kernel panic. While graceful shutdown normally quiesces userspace before invoking the reboot syscall, forced shutdowns (as observed on GCP VMs) can still trigger this path. Fix by calling netif_device_detach() in shutdown(). This marks the device as detached so the ethtool ioctl handler will skip dispatching operations to the driver.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-664 Improper Control of a Resource Through its Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38736\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization Syzbot reported shift-out-of-bounds exception on MDIO bus initialization. The PHY address should be masked to 5 bits (0-31). Without this mask, invalid PHY addresses could be used, potentially causing issues with MDIO bus operations. Fix this by masking the PHY address with 0x1f (31 decimal) to ensure it stays within the valid range.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39673\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic. 2. pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels. Fix these by using a lockless RCU approach: - Use list_first_or_null_rcu() to safely test and access the first list entry. - Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal. - Check for a NULL pch->chan before dereferencing it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39675\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() The function mod_hdcp_hdcp1_create_session() calls the function get_first_active_display(), but does not check its return value. The return value is a null pointer if the display list is empty. This will lead to a null pointer dereference. Add a null pointer check for get_first_active_display() and return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND if the function return null. This is similar to the commit c3e9826a2202 (\"drm/amd/display: Add null pointer check for get_first_active_display()\"). (cherry picked from commit 5e43eb3cd731649c4f8b9134f857be62a416c893)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39676\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Prevent a potential error pointer dereference The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-394 Unexpected Status Code or Return Value\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.1\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39681\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd (\"x86/resctrl: Query LLC monitoring properties once during boot\") resctrl_cpu_detect() has been moved from common CPU initialization code to the vendor-specific BSP init helper, while Hygon didn't put that call in their code. This triggers a division by zero fault during early booting stage on our machines with X86_FEATURE_CQM* supported, where get_rdt_mon_resources() tries to calculate mon_l3_config with uninitialized boot_cpu_data.x86_cache_occ_scale. Add the missing resctrl_cpu_detect() in the Hygon BSP init helper. [ bp: Massage commit message. ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-369 Divide By Zero\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39682\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39683\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser->buffer when trace_get_user failed When the length of the string written to set_ftrace_filter exceeds FTRACE_BUFF_MAX, the following KASAN alarm will be triggered: BUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0 Read of size 1 at addr ffff0000d00bd5ba by task ash/165 CPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x34/0x50 (C) dump_stack_lvl+0xa0/0x158 print_address_description.constprop.0+0x88/0x398 print_report+0xb0/0x280 kasan_report+0xa4/0xf0 __asan_report_load1_noabort+0x20/0x30 strsep+0x18c/0x1b0 ftrace_process_regex.isra.0+0x100/0x2d8 ftrace_regex_release+0x484/0x618 __fput+0x364/0xa58 ____fput+0x28/0x40 task_work_run+0x154/0x278 do_notify_resume+0x1f0/0x220 el0_svc+0xec/0xf0 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1ac/0x1b0 The reason is that trace_get_user will fail when processing a string longer than FTRACE_BUFF_MAX, but not set the end of parser->buffer to 0. Then an OOB access will be triggered in ftrace_regex_release-> ftrace_process_regex->strsep->strpbrk. We can solve this problem by limiting access to parser->buffer when trace_get_user failed.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39684\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() syzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`. A kernel buffer is allocated to hold `insn->n` samples (each of which is an `unsigned int`). For some instruction types, `insn->n` samples are copied back to user-space, unless an error code is being returned. The problem is that not all the instruction handlers that need to return data to userspace fill in the whole `insn->n` samples, so that there is an information leak. There is a similar syzbot report for `do_insnlist_ioctl()`, although it does not have a reproducer for it at the time of writing. One culprit is `insn_rw_emulate_bits()` which is used as the handler for `INSN_READ` or `INSN_WRITE` instructions for subdevices that do not have a specific handler for that instruction, but do have an `INSN_BITS` handler. For `INSN_READ` it only fills in at most 1 sample, so if `insn->n` is greater than 1, the remaining `insn->n - 1` samples copied to userspace will be uninitialized kernel data. Another culprit is `vm80xx_ai_insn_read()` in the \"vm80xx\" driver. It never returns an error, even if it fails to fill the buffer. Fix it in `do_insn_ioctl()` and `do_insnlist_ioctl()` by making sure that uninitialized parts of the allocated buffer are zeroed before handling each instruction. Thanks to Arnaud Lecomte for their fix to `do_insn_ioctl()`. That fix replaced the call to `kmalloc_array()` with `kcalloc()`, but it is not always necessary to clear the whole buffer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39685\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: pcl726: Prevent invalid irq number The reproducer passed in an irq number(0x80008000) that was too large, which triggered the oob. Added an interrupt number check to prevent users from passing in an irq number that was too large. If `it->options[1]` is 31, then `1 << it->options[1]` is still invalid because it shifts a 1-bit into the sign bit (which is UB in C). Possible solutions include reducing the upper bound on the `it->options[1]` value to 30 or lower, or using `1U << it->options[1]`. The old code would just not attempt to request the IRQ if the `options[1]` value were invalid. And it would still configure the device without interrupts even if the call to `request_irq` returned an error. So it would be better to combine this test with the test below.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39686\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: Make insn_rw_emulate_bits() do insn->n samples The `insn_rw_emulate_bits()` function is used as a default handler for `INSN_READ` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_READ`. Similarly, it is used as a default handler for `INSN_WRITE` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_WRITE`. It works by emulating the `INSN_READ` or `INSN_WRITE` instruction handling with a constructed `INSN_BITS` instruction. However, `INSN_READ` and `INSN_WRITE` instructions are supposed to be able read or write multiple samples, indicated by the `insn->n` value, but `insn_rw_emulate_bits()` currently only handles a single sample. For `INSN_READ`, the comedi core will copy `insn->n` samples back to user-space. (That triggered KASAN kernel-infoleak errors when `insn->n` was greater than 1, but that is being fixed more generally elsewhere in the comedi core.) Make `insn_rw_emulate_bits()` either handle `insn->n` samples, or return an error, to conform to the general expectation for `INSN_READ` and `INSN_WRITE` handlers.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39687\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: light: as73211: Ensure buffer holes are zeroed Given that the buffer is copied to a kfifo that ultimately user space can read, ensure we zero it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39689\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the reader keeps the pointer to the filter hashes. This is problematic because this pointer is static across function calls that release the locks that can update the global tracer hashes. This can cause UAF and similar bugs. Allocate and copy the hash for reading the filter files like it is done for the writers. This not only fixes UAF bugs, but also makes the code a bit simpler as it doesn't have to differentiate when to free the iterator's hash between writers and readers.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39691\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.16.0-862.14.0.6.x86_64 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: dump_stack_lvl+0x55/0x70 print_address_description.constprop.0+0x2c/0x390 print_report+0xb4/0x270 kasan_report+0xb8/0xf0 end_buffer_read_sync+0xe3/0x110 end_bio_bh_io_sync+0x56/0x80 blk_update_request+0x30a/0x720 scsi_end_request+0x51/0x2b0 scsi_io_completion+0xe3/0x480 ? scsi_device_unbusy+0x11e/0x160 blk_complete_reqs+0x7b/0x90 handle_softirqs+0xef/0x370 irq_exit_rcu+0xa5/0xd0 sysvec_apic_timer_interrupt+0x6e/0x90 Above issue happens when do ntfs3 filesystem mount, issue may happens as follows: mount IRQ ntfs_fill_super read_cache_page do_read_cache_folio filemap_read_folio mpage_read_folio do_mpage_readpage ntfs_get_block_vbo bh_read submit_bh wait_on_buffer(bh); blk_complete_reqs scsi_io_completion scsi_end_request blk_update_request end_bio_bh_io_sync end_buffer_read_sync __end_buffer_read_notouch unlock_buffer wait_on_buffer(bh);--> return will return to caller put_bh --> trigger stack-out-of-bounds In the mpage_read_folio() function, the stack variable 'map_bh' is passed to ntfs_get_block_vbo(). Once unlock_buffer() unlocks and wait_on_buffer() returns to continue processing, the stack variable is likely to be reclaimed. Consequently, during the end_buffer_read_sync() process, calling put_bh() may result in stack overrun. If the bh is not allocated on the stack, it belongs to a folio. Freeing a buffer head which belongs to a folio is done by drop_buffers() which will fail to free buffers which are still locked. So it is safe to call put_bh() before __end_buffer_read_notouch().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39692\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() We can't call destroy_workqueue(smb_direct_wq); before stop_sessions()! Otherwise already existing connections try to use smb_direct_wq as a NULL pointer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39693\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid a NULL pointer dereference [WHY] Although unlikely drm_atomic_get_new_connector_state() or drm_atomic_get_old_connector_state() can return NULL. [HOW] Check returns before dereference. (cherry picked from commit 1e5e8d672fec9f2ab352be121be971877bff2af9)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39694\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrupt is NULL. This check is performed after physical to virtual address translation. If the kernel identity mapping does not start at address zero, the resulting virtual address is never zero, so that the NULL checks won't work. Subsequently this may result in incorrect accesses to the first page of the identity mapping. Fix this by introducing a function that handles the NULL case before address translation.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39697\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_request() from succeeding until we actually lock the page group. The reason is that whoever called nfs_inode_remove_request() doesn't necessarily have a lock on the page group head. So in order to avoid races, let's take the page group lock earlier in nfs_lock_and_join_requests(), and hold it across the removal of the request in nfs_inode_remove_request().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39701\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: Fix the driver update version check The security-version-number check should be used rather than the runtime version check for driver updates. Otherwise, the firmware update would fail when the update binary had a lower runtime version number than the current one. [ rjw: Changelog edits ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1025 Comparison Using Wrong Factors\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39702\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-208 Observable Timing Discrepancy\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39703\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net, hsr: reject HSR frame if skb can't hold tag Receiving HSR frame with insufficient space to hold HSR tag in the skb can result in a crash (kernel BUG): [ 45.390915] skbuff: skb_under_panic: text:ffffffff86f32cac len:26 put:14 head:ffff888042418000 data:ffff888042417ff4 tail:0xe end:0x180 dev:bridge_slave_1 [ 45.392559] ------------[ cut here ]------------ [ 45.392912] kernel BUG at net/core/skbuff.c:211! [ 45.393276] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 45.393809] CPU: 1 UID: 0 PID: 2496 Comm: reproducer Not tainted 6.15.0 #12 PREEMPT(undef) [ 45.394433] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 45.395273] RIP: 0010:skb_panic+0x15b/0x1d0 [ 45.402911] Call Trace: [ 45.403105] [ 45.404470] skb_push+0xcd/0xf0 [ 45.404726] br_dev_queue_push_xmit+0x7c/0x6c0 [ 45.406513] br_forward_finish+0x128/0x260 [ 45.408483] __br_forward+0x42d/0x590 [ 45.409464] maybe_deliver+0x2eb/0x420 [ 45.409763] br_flood+0x174/0x4a0 [ 45.410030] br_handle_frame_finish+0xc7c/0x1bc0 [ 45.411618] br_handle_frame+0xac3/0x1230 [ 45.413674] __netif_receive_skb_core.constprop.0+0x808/0x3df0 [ 45.422966] __netif_receive_skb_one_core+0xb4/0x1f0 [ 45.424478] __netif_receive_skb+0x22/0x170 [ 45.424806] process_backlog+0x242/0x6d0 [ 45.425116] __napi_poll+0xbb/0x630 [ 45.425394] net_rx_action+0x4d1/0xcc0 [ 45.427613] handle_softirqs+0x1a4/0x580 [ 45.427926] do_softirq+0x74/0x90 [ 45.428196] This issue was found by syzkaller. The panic happens in br_dev_queue_push_xmit() once it receives a corrupted skb with ETH header already pushed in linear data. When it attempts the skb_push() call, there's not enough headroom and skb_push() panics. The corrupted skb is put on the queue by HSR layer, which makes a sequence of unintended transformations when it receives a specific corrupted HSR frame (with incomplete TAG). Fix it by dropping and consuming frames that are not long enough to contain both ethernet and hsr headers. Alternative fix would be to check for enough headroom before skb_push() in br_dev_queue_push_xmit(). In the reproducer, this is injected via AF_PACKET, but I don't easily see why it couldn't be sent over the wire from adjacent network. Further Details: In the reproducer, the following network interface chain is set up: \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 veth0_to_hsr \u251c\u2500\u2500\u2500\u2524 hsr_slave0 \u253c\u2500\u2500\u2500\u2510 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u251c\u2500\u2524 hsr0 \u251c\u2500\u2500\u2500\u2510 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 \u2502\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 veth1_to_hsr \u253c\u2500\u2500\u2500\u2524 hsr_slave1 \u251c\u2500\u2500\u2500\u2518 \u2514\u2524 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u250c\u253c bridge \u2502 \u2502\u2502 \u2502 \u2502\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 \u2502 ... \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 To trigger the events leading up to crash, reproducer sends a corrupted HSR fr ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1286 Improper Validation of Syntactic Correctness of Input\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39706\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq Since KFD proc content was moved to kernel debugfs, we can't destroy KFD debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line debugfs_remove_recursive(entry->proc_dentry); tries to remove /sys/kernel/debug/kfd/proc/ while /sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel NULL pointer. (cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39709\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: protect against spurious interrupts during probe Make sure the interrupt handler is initialized before the interrupt is registered. If the IRQ is registered before hfi_create(), it's possible that an interrupt fires before the handler setup is complete, leading to a NULL dereference. This error condition has been observed during system boot on Rb3Gen2.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39710\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: Add a check for packet size after reading from shared memory Add a check to ensure that the packet size does not exceed the number of available words after reading the packet header from shared memory. This ensures that the size provided by the firmware is safe to process and prevent potential out-of-bounds memory access.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39713\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() In the interrupt handler rain_interrupt(), the buffer full check on rain->buf_len is performed before acquiring rain->buf_lock. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as rain->buf_len is concurrently accessed and modified in the work handler rain_irq_work_handler() under the same lock. Multiple interrupt invocations can race, with each reading buf_len before it becomes full and then proceeding. This can lead to both interrupts attempting to write to the buffer, incrementing buf_len beyond its capacity (DATA_SIZE) and causing a buffer overflow. Fix this bug by moving the spin_lock() to before the buffer full check. This ensures that the check and the subsequent buffer modification are performed atomically, preventing the race condition. An corresponding spin_unlock() is added to the overflow path to correctly release the lock. This possible bug was found by an experimental static analysis tool developed by our team.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39714\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: usbtv: Lock resolution while streaming When an program is streaming (ffplay) and another program (qv4l2) changes the TV standard from NTSC to PAL, the kernel crashes due to trying to copy to unmapped memory. Changing from NTSC to PAL increases the resolution in the usbtv struct, but the video plane buffer isn't adjusted, so it overflows. [hverkuil: call vb2_is_busy instead of vb2_is_streaming]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39715\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: parisc: Revise gateway LWS calls to probe user read access We use load and stbys,e instructions to trigger memory reference interruptions without writing to memory. Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel and gateway page execute at privilege level 0, so this code never triggers a read access interruption. Thus, it is currently possible for user code to execute a LWS compare and swap operation at an address that is read protected at privilege level 3 (PRIV_USER). Fix this by probing read access rights at privilege level 3 and branching to lws_fault if access isn't allowed.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39716\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: parisc: Revise __get_user() to probe user read access Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel executes at privilege level 0, so __get_user() never triggers a read access interruption (code 26). Thus, it is currently possible for user code to access a read protected address via a system call. Fix this by probing read access rights at privilege level 3 (PRIV_USER) and setting __gu_err to -EFAULT (-14) if access isn't allowed. Note the cmpiclr instruction does a 32-bit compare because COND macro doesn't work inside asm.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39718\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately, virtio_vsock_skb_rx_put() uses the length from the packet header as the length argument to skb_put(), potentially resulting in SKB overflow if the host has gone wonky. Validate the length as advertised by the packet header before calling virtio_vsock_skb_rx_put().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.6\nHIGH\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39719\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: imu: bno055: fix OOB access of hw_xlate array Fix a potential out-of-bounds array access of the hw_xlate array in bno055.c. In bno055_get_regmask(), hw_xlate was iterated over the length of the vals array instead of the length of the hw_xlate array. In the case of bno055_gyr_scale, the vals array is larger than the hw_xlate array, so this could result in an out-of-bounds access. In practice, this shouldn't happen though because a match should always be found which breaks out of the for loop before it iterates beyond the end of the hw_xlate array. By adding a new hw_xlate_len field to the bno055_sysfs_attr, we can be sure we are iterating over the correct length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39724\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix panic due to PSLVERR When the PSLVERR_RESP_EN parameter is set to 1, the device generates an error response if an attempt is made to read an empty RBR (Receive Buffer Register) while the FIFO is enabled. In serial8250_do_startup(), calling serial_port_out(port, UART_LCR, UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes dw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter function enables the FIFO via serial_out(p, UART_FCR, p->fcr). Execution proceeds to the serial_port_in(port, UART_RX). This satisfies the PSLVERR trigger condition. When another CPU (e.g., using printk()) is accessing the UART (UART is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter dw8250_force_idle(). Put serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock to fix this issue. Panic backtrace: [ 0.442336] Oops - unknown exception [#1] [ 0.442343] epc : dw8250_serial_in32+0x1e/0x4a [ 0.442351] ra : serial8250_do_startup+0x2c8/0x88e ... [ 0.442416] console_on_rootfs+0x26/0x70\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39736\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() can cause a deadlock due to lock inversion with the netconsole subsystem. This occurs because pr_warn_once() may trigger netpoll, which eventually leads to __alloc_skb() and back into kmemleak code, attempting to reacquire kmemleak_lock. This is the path for the deadlock. mem_pool_alloc() -> raw_spin_lock_irqsave(&kmemleak_lock, flags); -> pr_warn_once() -> netconsole subsystem -> netpoll -> __alloc_skb -> __create_object -> raw_spin_lock_irqsave(&kmemleak_lock, flags); Fix this by setting a flag and issuing the pr_warn_once() after kmemleak_lock is released.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-833 Deadlock\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39737\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() A soft lockup warning was observed on a relative small system x86-64 system with 16 GB of memory when running a debug kernel with kmemleak enabled. watchdog: BUG: soft lockup - CPU#8 stuck for 33s! [kworker/8:1:134] The test system was running a workload with hot unplug happening in parallel. Then kemleak decided to disable itself due to its inability to allocate more kmemleak objects. The debug kernel has its CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE set to 40,000. The soft lockup happened in kmemleak_do_cleanup() when the existing kmemleak objects were being removed and deleted one-by-one in a loop via a workqueue. In this particular case, there are at least 40,000 objects that need to be processed and given the slowness of a debug kernel and the fact that a raw_spinlock has to be acquired and released in __delete_object(), it could take a while to properly handle all these objects. As kmemleak has been disabled in this case, the object removal and deletion process can be further optimized as locking isn't really needed. However, it is probably not worth the effort to optimize for such an edge case that should rarely happen. So the simple solution is to call cond_resched() at periodic interval in the iteration loop to avoid soft lockup.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39738\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: do not allow relocation of partially dropped subvolumes [BUG] There is an internal report that balance triggered transaction abort, with the following call trace: item 85 key (594509824 169 0) itemoff 12599 itemsize 33 extent refs 1 gen 197740 flags 2 ref#0: tree block backref root 7 item 86 key (594558976 169 0) itemoff 12566 itemsize 33 extent refs 1 gen 197522 flags 2 ref#0: tree block backref root 7 ... BTRFS error (device loop0): extent item not found for insert, bytenr 594526208 num_bytes 16384 parent 449921024 root_objectid 934 owner 1 offset 0 BTRFS error (device loop0): failed to run delayed ref for logical 594526208 num_bytes 16384 type 182 action 1 ref_mod 1: -117 ------------[ cut here ]------------ BTRFS: Transaction aborted (error -117) WARNING: CPU: 1 PID: 6963 at ../fs/btrfs/extent-tree.c:2168 btrfs_run_delayed_refs+0xfa/0x110 [btrfs] And btrfs check doesn't report anything wrong related to the extent tree. [CAUSE] The cause is a little complex, firstly the extent tree indeed doesn't have the backref for 594526208. The extent tree only have the following two backrefs around that bytenr on-disk: item 65 key (594509824 METADATA_ITEM 0) itemoff 13880 itemsize 33 refs 1 gen 197740 flags TREE_BLOCK tree block skinny level 0 (176 0x7) tree block backref root CSUM_TREE item 66 key (594558976 METADATA_ITEM 0) itemoff 13847 itemsize 33 refs 1 gen 197522 flags TREE_BLOCK tree block skinny level 0 (176 0x7) tree block backref root CSUM_TREE But the such missing backref item is not an corruption on disk, as the offending delayed ref belongs to subvolume 934, and that subvolume is being dropped: item 0 key (934 ROOT_ITEM 198229) itemoff 15844 itemsize 439 generation 198229 root_dirid 256 bytenr 10741039104 byte_limit 0 bytes_used 345571328 last_snapshot 198229 flags 0x1000000000001(RDONLY) refs 0 drop_progress key (206324 EXTENT_DATA 2711650304) drop_level 2 level 2 generation_v2 198229 And that offending tree block 594526208 is inside the dropped range of that subvolume. That explains why there is no backref item for that bytenr and why btrfs check is not reporting anything wrong. But this also shows another problem, as btrfs will do all the orphan subvolume cleanup at a read-write mount. So half-dropped subvolume should not exist after an RW mount, and balance itself is also exclusive to subvolume cleanup, meaning we shouldn't hit a subvolume half-dropped during relocation. The root cause is, there is no orphan item for this subvolume. In fact there are 5 subvolumes from around 2021 that have the same problem. It looks like the original report has some older kernels running, and caused those zombie subvolumes. Thankfully upstream commit 8d488a8c7ba2 (\"btrfs: fix subvolume/snapshot deletion not triggered on mount\") has long fixed the bug. [ENHANCEMENT] For repairing such old fs, btrfs-progs will be enhanced. Considering how delayed the problem will show up (at run delayed ref time) and at that time we have to abort transaction already, it is too late. Instead here we reject any half-dropped subvolume for reloc tree at the earliest time, preventing confusion and extra time wasted on debugging similar bugs.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39742\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() The function divides number of online CPUs by num_core_siblings, and later checks the divider by zero. This implies a possibility to get and divide-by-zero runtime error. Fix it by moving the check prior to division. This also helps to save one indentation level.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-369 Divide By Zero\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39743\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: truncate good inode pages when hard link is 0 The fileset value of the inode copy from the disk by the reproducer is AGGR_RESERVED_I. When executing evict, its hard link number is 0, so its inode pages are not truncated. This causes the bugon to be triggered when executing clear_inode() because nrpages is greater than 0.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39749\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: rcu: Protect ->defer_qs_iw_pending from data race On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke rcu_read_unlock_special(), which uses an irq-work handler to force the system to notice when the RCU read-side critical section actually ends. That end won't happen until interrupts are enabled at the soonest. In some kernels, such as those booted with rcutree.use_softirq=y, the irq-work handler is used unconditionally. The per-CPU rcu_data structure's ->defer_qs_iw_pending field is updated by the irq-work handler and is both read and updated by rcu_read_unlock_special(). This resulted in the following KCSAN splat: ------------------------------------------------------------------------ BUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special read to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8: rcu_read_unlock_special+0x175/0x260 __rcu_read_unlock+0x92/0xa0 rt_spin_unlock+0x9b/0xc0 __local_bh_enable+0x10d/0x170 __local_bh_enable_ip+0xfb/0x150 rcu_do_batch+0x595/0xc40 rcu_cpu_kthread+0x4e9/0x830 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 write to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8: rcu_preempt_deferred_qs_handler+0x1e/0x30 irq_work_single+0xaf/0x160 run_irq_workd+0x91/0xc0 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 no locks held by irq_work/8/88. irq event stamp: 200272 hardirqs last enabled at (200272): [] finish_task_switch+0x131/0x320 hardirqs last disabled at (200271): [] __schedule+0x129/0xd70 softirqs last enabled at (0): [] copy_process+0x4df/0x1cc0 softirqs last disabled at (0): [<0000000000000000>] 0x0 ------------------------------------------------------------------------ The problem is that irq-work handlers run with interrupts enabled, which means that rcu_preempt_deferred_qs_handler() could be interrupted, and that interrupt handler might contain an RCU read-side critical section, which might invoke rcu_read_unlock_special(). In the strict KCSAN mode of operation used by RCU, this constitutes a data race on the ->defer_qs_iw_pending field. This commit therefore disables interrupts across the portion of the rcu_preempt_deferred_qs_handler() that updates the ->defer_qs_iw_pending field. This suffices because this handler is not a fast path.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39752\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ARM: rockchip: fix kernel hang during smp initialization In order to bring up secondary CPUs main CPU write trampoline code to SRAM. The trampoline code is written while secondary CPUs are powered on (at least that true for RK3188 CPU). Sometimes that leads to kernel hang. Probably because secondary CPU execute trampoline code while kernel doesn't expect. The patch moves SRAM initialization step to the point where all secondary CPUs are powered down. That fixes rarely hangs on RK3188: [ 0.091568] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.091996] rockchip_smp_prepare_cpus: ncores 4\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-364 Signal Handler Race Condition\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39756\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c: WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288 This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN. Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate: - File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes - Multiple bitmaps: ~400MB - Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647) Reproducer: 1. Set /proc/sys/fs/nr_open to 1073741816: # echo 1073741816 > /proc/sys/fs/nr_open 2. Run a program that uses a high file descriptor: #include #include int main() { struct rlimit rlim = {1073741824, 1073741824}; setrlimit(RLIMIT_NOFILE, &rlim); dup2(2, 1073741880); // Triggers the warning return 0; } 3. Observe WARNING in dmesg at mm/slub.c:5027 systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that: 1. The kernel's allocation functions still enforce INT_MAX as a maximum size regardless of memcg accounting 2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations 3. The resulting allocations (>8GB) are impractical and will always fail systemd's algorithm starts with INT_MAX and keeps halving the value until the kernel accepts it. On most systems, this results in nr_open being set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors. While processes rarely use file descriptors near this limit in normal operation, certain selftests (like tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue. Fix this by adding a check in alloc_fdtable() to ensure the requested allocation size does not exceed INT_MAX. This causes the operation to fail with -EMFILE instead of triggering a kernel warning and avoids the impractical >8GB memory allocation request.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39757\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39759\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix race between quota disable and quota rescan ioctl There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fs_info->qgroup_tree rbtree. This happens as follows: 1) Task A enters btrfs_ioctl_quota_rescan() -> btrfs_qgroup_rescan(); 2) Task B enters btrfs_quota_disable() and calls btrfs_qgroup_wait_for_completion(), which does nothing because at that point fs_info->qgroup_rescan_running is false (it wasn't set yet by task A); 3) Task B calls btrfs_free_qgroup_config() which starts freeing qgroups from fs_info->qgroup_tree without taking the lock fs_info->qgroup_lock; 4) Task A enters qgroup_rescan_zero_tracking() which starts iterating the fs_info->qgroup_tree tree while holding fs_info->qgroup_lock, but task B is freeing qgroup records from that tree without holding the lock, resulting in a use-after-free. Fix this by taking fs_info->qgroup_lock at btrfs_free_qgroup_config(). Also at btrfs_qgroup_rescan() don't start the rescan worker if quotas were already disabled.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39760\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this up by checking the size first before looking at any of the fields in the descriptor.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39766\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \\ htb rate 64bit tc qdisc add dev lo parent 1:1 handle f: \\ cake memlimit 1b ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 This is because the low memlimit leads to a low buffer_limit, which causes packet dropping. However, cake_enqueue still returns NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an empty child qdisc. We should return NET_XMIT_CN when packets are dropped from the same tin and flow. I do not believe return value of NET_XMIT_CN is necessary for packet drops in the case of ack filtering, as that is meant to optimize performance, not to signal congestion.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39770\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM When performing Generic Segmentation Offload (GSO) on an IPv6 packet that contains extension headers, the kernel incorrectly requests checksum offload if the egress device only advertises NETIF_F_IPV6_CSUM feature, which has a strict contract: it supports checksum offload only for plain TCP or UDP over IPv6 and explicitly does not support packets with extension headers. The current GSO logic violates this contract by failing to disable the feature for packets with extension headers, such as those used in GREoIPv6 tunnels. This violation results in the device being asked to perform an operation it cannot support, leading to a `skb_warn_bad_offload` warning and a collapse of network throughput. While device TSO/USO is correctly bypassed in favor of software GSO for these packets, the GSO stack must be explicitly told not to request checksum offload. Mask NETIF_F_IPV6_CSUM, NETIF_F_TSO6 and NETIF_F_GSO_UDP_L4 in gso_features_check if the IPv6 header contains extension headers to compute checksum in software. The exception is a BIG TCP extension, which, as stated in commit 68e068cabd2c6c53 (\"net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets\"): \"The feature is only enabled on devices that support BIG TCP TSO. The header is only present for PF_PACKET taps like tcpdump, and not transmitted by physical devices.\" kernel log output (truncated): WARNING: CPU: 1 PID: 5273 at net/core/dev.c:3535 skb_warn_bad_offload+0x81/0x140 ... Call Trace: skb_checksum_help+0x12a/0x1f0 validate_xmit_skb+0x1a3/0x2d0 validate_xmit_skb_list+0x4f/0x80 sch_direct_xmit+0x1a2/0x380 __dev_xmit_skb+0x242/0x670 __dev_queue_xmit+0x3fc/0x7f0 ip6_finish_output2+0x25e/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_tnl_xmit+0x608/0xc00 [ip6_tunnel] ip6gre_tunnel_xmit+0x1c0/0x390 [ip6_gre] dev_hard_start_xmit+0x63/0x1c0 __dev_queue_xmit+0x6d0/0x7f0 ip6_finish_output2+0x214/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 inet6_csk_xmit+0xeb/0x150 __tcp_transmit_skb+0x555/0xa80 tcp_write_xmit+0x32a/0xe90 tcp_sendmsg_locked+0x437/0x1110 tcp_sendmsg+0x2f/0x50 ... skb linear: 00000000: e4 3d 1a 7d ec 30 e4 3d 1a 7e 5d 90 86 dd 60 0e skb linear: 00000010: 00 0a 1b 34 3c 40 20 11 00 00 00 00 00 00 00 00 skb linear: 00000020: 00 00 00 00 00 12 20 11 00 00 00 00 00 00 00 00 skb linear: 00000030: 00 00 00 00 00 11 2f 00 04 01 04 01 01 00 00 00 skb linear: 00000040: 86 dd 60 0e 00 0a 1b 00 06 40 20 23 00 00 00 00 skb linear: 00000050: 00 00 00 00 00 00 00 00 00 12 20 23 00 00 00 00 skb linear: 00000060: 00 00 00 00 00 00 00 00 00 11 bf 96 14 51 13 f9 skb linear: 00000070: ae 27 a0 a8 2b e3 80 18 00 40 5b 6f 00 00 01 01 skb linear: 00000080: 08 0a 42 d4 50 d5 4b 70 f8 1a\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-573 Improper Following of Specification by Caller\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39772\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/hisilicon/hibmc: fix the hibmc loaded failed bug When hibmc loaded failed, the driver use hibmc_unload to free the resource, but the mutexes in mode.config are not init, which will access an NULL pointer. Just change goto statement to return, because hibnc_hw_init() doesn't need to free anything.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39773\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() When set multicast_query_interval to a large value, the local variable 'time' in br_multicast_send_query() may overflow. If the time is smaller than jiffies, the timer will expire immediately, and then call mod_timer() again, which creates a loop and may trigger the following soft lockup issue. watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rb_consumer:66] CPU: 1 UID: 0 PID: 66 Comm: rb_consumer Not tainted 6.16.0+ #259 PREEMPT(none) Call Trace: __netdev_alloc_skb+0x2e/0x3a0 br_ip6_multicast_alloc_query+0x212/0x1b70 __br_multicast_send_query+0x376/0xac0 br_multicast_send_query+0x299/0x510 br_multicast_query_expired.constprop.0+0x16d/0x1b0 call_timer_fn+0x3b/0x2a0 __run_timers+0x619/0x950 run_timer_softirq+0x11c/0x220 handle_softirqs+0x18e/0x560 __irq_exit_rcu+0x158/0x1a0 sysvec_apic_timer_interrupt+0x76/0x90 This issue can be reproduced with: ip link add br0 type bridge echo 1 > /sys/class/net/br0/bridge/multicast_querier echo 0xffffffffffffffff > /sys/class/net/br0/bridge/multicast_query_interval ip link set dev br0 up The multicast_startup_query_interval can also cause this issue. Similar to the commit 99b40610956a (\"net: bridge: mcast: add and enforce query interval minimum\"), add check for the query interval maximum to fix this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39776\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: clear page table entries at destroy_args() The mm/debug_vm_pagetable test allocates manually page table entries for the tests it runs, using also its manually allocated mm_struct. That in itself is ok, but when it exits, at destroy_args() it fails to clear those entries with the *_clear functions. The problem is that leaves stale entries. If another process allocates an mm_struct with a pgd at the same address, it may end up running into the stale entry. This is happening in practice on a debug kernel with CONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra debugging I added (it prints a warning trace if pgtables_bytes goes negative, in addition to the warning at check_mm() function): [ 2.539353] debug_vm_pgtable: [get_random_vaddr ]: random_vaddr is 0x7ea247140000 [ 2.539366] kmem_cache info [ 2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508 [ 2.539447] debug_vm_pgtable: [init_args ]: args->mm is 0x000000002267cc9e (...) [ 2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0 [ 2.552816] Modules linked in: [ 2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY [ 2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries [ 2.552872] NIP: c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90 [ 2.552885] REGS: c0000000622e73b0 TRAP: 0700 Not tainted (6.12.0-105.debug_vm2.el10.ppc64le+debug) [ 2.552899] MSR: 800000000282b033 CR: 24002822 XER: 0000000a [ 2.552954] CFAR: c0000000008f03f0 IRQMASK: 0 [ 2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001 [ 2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff [ 2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000 [ 2.552954] GPR12: 00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb [ 2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0 [ 2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000 [ 2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001 [ 2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760 [ 2.553170] NIP [c0000000007eef3c] free_pud_range+0x8bc/0x8d0 [ 2.553185] LR [c0000000007eef30] free_pud_range+0x8b0/0x8d0 [ 2.553199] Call Trace: [ 2.553207] [c0000000622e7650] [c0000000007eef30] free_pud_range+0x8b0/0x8d0 (unreliable) [ 2.553229] [c0000000622e7750] [c0000000007f40b4] free_pgd_range+0x284/0x3b0 [ 2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables+0x450/0x570 [ 2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap+0x250/0x650 [ 2.553292] [c0000000622e7a30] [c0000000001b95b8] __mmput+0x98/0x290 [ 2.558344] [c0000000622e7a80] [c0000000001d1018] exit_mm+0x118/0x1b0 [ 2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit+0x2ec/0x870 [ 2.558376] [c0000000622e7b60] [c0000000001d1ca8] do_group_exit+0x88/0x150 [ 2.558391] [c0000000622e7bb0] [c0000000001d1db8] sys_exit_group+0x48/0x50 [ 2.558407] [c0000000622e7be0] [c00000000003d810] system_call_exception+0x1e0/0x4c0 [ 2.558423] [c0000000622e7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec (...) [ 2.558892] ---[ end trace 0000000000000000 ]--- [ 2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1 [ 2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144 Here the modprobe process ended up with an allocated mm_struct from the mm_struct slab that was used before by the debug_vm_pgtable test. That is not a problem, since the mm_stru ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39782\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2_log_do_checkpoint() Both jbd2_log_do_checkpoint() and jbd2_journal_shrink_checkpoint_list() periodically release j_list_lock after processing a batch of buffers to avoid long hold times on the j_list_lock. However, since both functions contend for j_list_lock, the combined time spent waiting and processing can be significant. jbd2_journal_shrink_checkpoint_list() explicitly calls cond_resched() when need_resched() is true to avoid softlockups during prolonged operations. But jbd2_log_do_checkpoint() only exits its loop when need_resched() is true, relying on potentially sleeping functions like __flush_batch() or wait_on_buffer() to trigger rescheduling. If those functions do not sleep, the kernel may hit a softlockup. watchdog: BUG: soft lockup - CPU#3 stuck for 156s! [kworker/u129:2:373] CPU: 3 PID: 373 Comm: kworker/u129:2 Kdump: loaded Not tainted 6.6.0+ #10 Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.27 06/13/2017 Workqueue: writeback wb_workfn (flush-7:2) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : native_queued_spin_lock_slowpath+0x358/0x418 lr : jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] Call trace: native_queued_spin_lock_slowpath+0x358/0x418 jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] __jbd2_log_wait_for_space+0xfc/0x2f8 [jbd2] add_transaction_credits+0x3bc/0x418 [jbd2] start_this_handle+0xf8/0x560 [jbd2] jbd2__journal_start+0x118/0x228 [jbd2] __ext4_journal_start_sb+0x110/0x188 [ext4] ext4_do_writepages+0x3dc/0x740 [ext4] ext4_writepages+0xa4/0x190 [ext4] do_writepages+0x94/0x228 __writeback_single_inode+0x48/0x318 writeback_sb_inodes+0x204/0x590 __writeback_inodes_wb+0x54/0xf8 wb_writeback+0x2cc/0x3d8 wb_do_writeback+0x2e0/0x2f8 wb_workfn+0x80/0x2a8 process_one_work+0x178/0x3e8 worker_thread+0x234/0x3b8 kthread+0xf0/0x108 ret_from_fork+0x10/0x20 So explicitly call cond_resched() in jbd2_log_do_checkpoint() to avoid softlockup.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39783\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, not a list entry. This list_del() call triggers a KASAN warning when an endpoint function driver which has a configfs attribute group is torn down: ================================================================== BUG: KASAN: slab-use-after-free in pci_epf_remove_cfs+0x17c/0x198 Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319 CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE Hardware name: Radxa ROCK 5B (DT) Call trace: show_stack+0x2c/0x84 (C) dump_stack_lvl+0x70/0x98 print_report+0x17c/0x538 kasan_report+0xb8/0x190 __asan_report_store8_noabort+0x20/0x2c pci_epf_remove_cfs+0x17c/0x198 pci_epf_unregister_driver+0x18/0x30 nvmet_pci_epf_cleanup_module+0x24/0x30 [nvmet_pci_epf] __arm64_sys_delete_module+0x264/0x424 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xac/0x230 do_el0_svc+0x40/0x58 el0_svc+0x48/0xdc el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c ... Remove this incorrect list_del() call from pci_epf_remove_cfs().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39787\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdt_loader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39788\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the driver ends up programming the UTRL_NEXUS_TYPE incorrectly as 0. This is because the left hand side of the shift is 1, which is of type int, i.e. 31 bits wide. Shifting by more than that width results in undefined behaviour. Fix this by switching to the BIT() macro, which applies correct type casting as required. This ensures the correct value is written to UTRL_NEXUS_TYPE (0xffffffff on gs101), and it also fixes a UBSAN shift warning: UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21 shift exponent 32 is too large for 32-bit type 'int' For consistency, apply the same change to the nutmrs / UTMRL_NEXUS_TYPE write.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39790\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a read pointer that is multiple elements ahead of the host's read pointer. For instance, if the host accesses an event ring while the device is updating it, the pointer inside of the event might still point to an old TRE. If the host uses the channel's xfer_cb() to directly free the buffer pointed to by the TRE, the buffer will be double-freed. This behavior was observed on an ep that used upstream EP stack without 'commit 6f18d174b73d (\"bus: mhi: ep: Update read pointer only after buffer is written\")'. Where the device updated the events ring pointer before updating the event contents, so it left a window where the host was able to access the stale data the event pointed to, before the device had the chance to update them. The usual pattern was that the host received an event pointing to a TRE that is not immediately after the last processed one, so it got treated as if it was a chained transaction, processing all of the TREs in between the two read pointers. This commit aims to harden the host by ensuring transactions where the event points to a TRE that isn't local_rp + 1 are chained. [mani: added stable tag and reworded commit message]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-415 Double Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.7\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39794\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ARM: tegra: Use I/O memcpy to write to IRAM Kasan crashes the kernel trying to check boundaries when using the normal memcpy.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39795\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: block: avoid possible overflow for chunk_sectors check in blk_stack_limits() In blk_stack_limits(), we check that the t->chunk_sectors value is a multiple of the t->physical_block_size value. However, by finding the chunk_sectors value in bytes, we may overflow the unsigned int which holds chunk_sectors, so change the check to be based on sectors.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-674 Uncontrolled Recursion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39798\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: NFS: Fix the setting of capabilities when automounting a new filesystem Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, and then probed for again.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-273 Improper Check for Dropped Privileges\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39800\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() If we find an unexpected generation for the extent buffer we are cloning at btrfs_copy_root(), we just WARN_ON() and don't error out and abort the transaction, meaning we allow to persist metadata with an unexpected generation. Instead of warning only, abort the transaction and return -EUCLEAN.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39801\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARN_ON for device endpoint command timeouts This commit addresses a rarely observed endpoint command timeout which causes kernel panic due to warn when 'panic_on_warn' is enabled and unnecessary call trace prints when 'panic_on_warn' is disabled. It is seen during fast software-controlled connect/disconnect testcases. The following is one such endpoint command timeout that we observed: 1. Connect ======= ->dwc3_thread_interrupt ->dwc3_ep0_interrupt ->configfs_composite_setup ->composite_setup ->usb_ep_queue ->dwc3_gadget_ep0_queue ->__dwc3_gadget_ep0_queue ->__dwc3_ep0_do_control_data ->dwc3_send_gadget_ep_cmd 2. Disconnect ========== ->dwc3_thread_interrupt ->dwc3_gadget_disconnect_interrupt ->dwc3_ep0_reset_state ->dwc3_ep0_end_control_data ->dwc3_send_gadget_ep_cmd In the issue scenario, in Exynos platforms, we observed that control transfers for the previous connect have not yet been completed and end transfer command sent as a part of the disconnect sequence and processing of USB_ENDPOINT_HALT feature request from the host timeout. This maybe an expected scenario since the controller is processing EP commands sent as a part of the previous connect. It maybe better to remove WARN_ON in all places where device endpoint commands are sent to avoid unnecessary kernel panic due to warn.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39806\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes. mt_report_fixup() attempts to patch byte offset 607 of the descriptor with 0x25 by first checking if byte offset 607 is 0x15 however it lacks bounds checks to verify if the descriptor is big enough before conducting this check. Fix this bug by ensuring the descriptor size is at least 608 bytes before accessing it. Below is the KASAN splat after the out of bounds access happens: [ 13.671954] ================================================================== [ 13.672667] BUG: KASAN: slab-out-of-bounds in mt_report_fixup+0x103/0x110 [ 13.673297] Read of size 1 at addr ffff888103df39df by task kworker/0:1/10 [ 13.673297] [ 13.673297] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-00005-gec5d573d83f4-dirty #3 [ 13.673297] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/04 [ 13.673297] Call Trace: [ 13.673297] [ 13.673297] dump_stack_lvl+0x5f/0x80 [ 13.673297] print_report+0xd1/0x660 [ 13.673297] kasan_report+0xe5/0x120 [ 13.673297] __asan_report_load1_noabort+0x18/0x20 [ 13.673297] mt_report_fixup+0x103/0x110 [ 13.673297] hid_open_report+0x1ef/0x810 [ 13.673297] mt_probe+0x422/0x960 [ 13.673297] hid_device_probe+0x2e2/0x6f0 [ 13.673297] really_probe+0x1c6/0x6b0 [ 13.673297] __driver_probe_device+0x24f/0x310 [ 13.673297] driver_probe_device+0x4e/0x220 [ 13.673297] __device_attach_driver+0x169/0x320 [ 13.673297] bus_for_each_drv+0x11d/0x1b0 [ 13.673297] __device_attach+0x1b8/0x3e0 [ 13.673297] device_initial_probe+0x12/0x20 [ 13.673297] bus_probe_device+0x13d/0x180 [ 13.673297] device_add+0xe3a/0x1670 [ 13.673297] hid_add_device+0x31d/0xa40 [...]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39808\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger page fault error for address(0xffffffffffffff58) add null check logic to ntrig_report_version() before calling hid_to_usb_dev()\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39812\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior. Clear sin6_scope_id and sin6_flowinfo. BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390 sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452 sctp_get_port net/sctp/socket.c:8523 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable addr.i.i created at: sctp_get_port net/sctp/socket.c:8515 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39813\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition. The issue occurs because: CPU0 (ftrace_dump) CPU1 (reader) echo z > /proc/sysrq-trigger !trace_empty(&iter) trace_iterator_reset(&iter) <- len = size = 0 cat /sys/kernel/tracing/trace_pipe trace_find_next_entry_inc(&iter) __find_next_entry ring_buffer_empty_cpu <- all empty return NULL trace_printk_seq(&iter.seq) WARN_ON_ONCE(s->seq.len >= s->seq.size) In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers. This caused trace_find_next_entry_inc to return NULL, failing to populate `iter.seq`. At this point, due to the prior trace_iterator_reset, both `iter.seq.len` and `iter.seq.size` were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered. Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39817\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe8/0x190 __asan_loadN+0x1c/0x28 memcmp+0x98/0xd0 efivarfs_d_compare+0x68/0xd8 __d_lookup_rcu_op_compare+0x178/0x218 __d_lookup_rcu+0x1f8/0x228 d_alloc_parallel+0x150/0x648 lookup_open.isra.0+0x5f0/0x8d0 open_last_lookups+0x264/0x828 path_openat+0x130/0x3f8 do_filp_open+0x114/0x248 do_sys_openat2+0x340/0x3c0 __arm64_sys_openat+0x120/0x1a0 If dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become negative, leadings to oob. The issue can be triggered by parallel lookups using invalid filename: T1 T2 lookup_open ->lookup simple_lookup d_add // invalid dentry is added to hash list lookup_open d_alloc_parallel __d_lookup_rcu __d_lookup_rcu_op_compare hlist_bl_for_each_entry_rcu // invalid dentry can be retrieved ->d_compare efivarfs_d_compare // oob Fix it by checking 'guid' before cmp.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39819\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/smb: Fix inconsistent refcnt update A possible inconsistent update of refcount was identified in `smb2_compound_op`. Such inconsistent update could lead to possible resource leaks. Why it is a possible bug: 1. In the comment section of the function, it clearly states that the reference to `cfile` should be dropped after calling this function. 2. Every control flow path would check and drop the reference to `cfile`, except the patched one. 3. Existing callers would not handle refcount update of `cfile` if -ENOMEM is returned. To fix the bug, an extra goto label \"out\" is added, to make sure that the cleanup logic would always be respected. As the problem is caused by the allocation failure of `vars`, the cleanup logic between label \"finished\" and \"out\" can be safely ignored. According to the definition of function `is_replayable_error`, the error code of \"-ENOMEM\" is not recoverable. Therefore, the replay logic also gets ignored.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39823\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39824\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device. This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees. 0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection Below is the KASAN splat after triggering the UAF: [ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700] __kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700] __kasan_slab_free+0x3c/0x50 [ 21.673700] kfre ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39825\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file. Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39826\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths. For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues. This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39827\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock. This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of rose_neigh->use when rose_neigh->count is incremented or decremented. This patch also modifies rose_rt_free(), rose_rt_device_down() and rose_clear_route() to properly release references to rose_neigh objects before freeing a rose_node through rose_remove_node(). These changes ensure rose_neigh structures are properly freed only when all references, including those from rose_node structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39828\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). syzbot reported the splat below. [0] When atmtcp_v_open() or atmtcp_v_close() is called via connect() or close(), atmtcp_send_control() is called to send an in-kernel special message. The message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length. Also, a pointer of struct atm_vcc is set to atmtcp_control.vcc. The notable thing is struct atmtcp_control is uAPI but has a space for an in-kernel pointer. struct atmtcp_control { struct atmtcp_hdr hdr; /* must be first */ ... atm_kptr_t vcc; /* both directions */ ... } __ATM_API_ALIGN; typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t; The special message is processed in atmtcp_recv_control() called from atmtcp_c_send(). atmtcp_c_send() is vcc->dev->ops->send() and called from 2 paths: 1. .ndo_start_xmit() (vcc->send() == atm_send_aal0()) 2. vcc_sendmsg() The problem is sendmsg() does not validate the message length and userspace can abuse atmtcp_recv_control() to overwrite any kptr by atmtcp_control. Let's add a new ->pre_send() hook to validate messages from sendmsg(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI KASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f] CPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline] RIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297 Code: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c RSP: 0018:ffffc90003f5f810 EFLAGS: 00010203 RAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c RBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd R10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000 R13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff FS: 00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0 Call Trace: vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8d7e96a4a9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9 RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005 RBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac R13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250 Modules linked in:\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39835\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: xfs: do not propagate ENODATA disk errors into xattr code ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code; namely, that the requested attribute name could not be found. However, a medium error from disk may also return ENODATA. At best, this medium error may escape to userspace as \"attribute not found\" when in fact it's an IO (disk) error. At worst, we may oops in xfs_attr_leaf_get() when we do: error = xfs_attr_leaf_hasname(args, &bp); if (error == -ENOATTR) { xfs_trans_brelse(args->trans, bp); return error; } because an ENODATA/ENOATTR error from disk leaves us with a null bp, and the xfs_trans_brelse will then null-deref it. As discussed on the list, we really need to modify the lower level IO functions to trap all disk errors and ensure that we don't let unique errors like this leak up into higher xfs functions - many like this should be remapped to EIO. However, this patch directly addresses a reported bug in the xattr code, and should be safe to backport to stable kernels. A larger-scope patch to handle more unique errors at lower levels can follow later. (Note, prior to 07120f1abdff we did not oops, but we did return the wrong error code to userspace.)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39838\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash. This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and returns NULL early to prevent dereferencing NULL pointer. Found by Linux Verification Center (linuxtesting.org) with SVACE\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39839\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39841\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF. Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39842\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already been executed in ocfs2_dismount_volume(), so osb->journal must be NULL. Therefore, the following calltrace will inevitably fail when it reaches jbd2_journal_release_jbd_inode(). ocfs2_dismount_volume()-> ocfs2_delete_osb()-> ocfs2_free_slot_info()-> __ocfs2_free_slot_info()-> evict()-> ocfs2_evict_inode()-> ocfs2_clear_inode()-> jbd2_journal_release_jbd_inode(osb->journal->j_journal, Adding osb->journal checks will prevent null-ptr-deref during the above execution path.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39843\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but when enabled CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare, and try to hold the per_cpu(hrtimer_bases)[n].lock. Avoid deadlock caused by implicitly waking up kswapd by passing in allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the debug_objects_fill_pool() case. Inside stack depot they are processed by gfp_nested_mask(). Since ___slab_alloc() has preemption disabled, we mask out __GFP_DIRECT_RECLAIM from the flags there. The oops looks something like: BUG: spinlock recursion on CPU#3, swapper/3/0 lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3 Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT) Call trace: spin_bug+0x0 _raw_spin_lock_irqsave+0x80 hrtimer_try_to_cancel+0x94 task_contending+0x10c enqueue_dl_entity+0x2a4 dl_server_start+0x74 enqueue_task_fair+0x568 enqueue_task+0xac do_activate_task+0x14c ttwu_do_activate+0xcc try_to_wake_up+0x6c8 default_wake_function+0x20 autoremove_wake_function+0x1c __wake_up+0xac wakeup_kswapd+0x19c wake_all_kswapds+0x78 __alloc_pages_slowpath+0x1ac __alloc_pages_noprof+0x298 stack_depot_save_flags+0x6b0 stack_depot_save+0x14 set_track_prepare+0x5c ___slab_alloc+0xccc __kmalloc_cache_noprof+0x470 __set_page_owner+0x2bc post_alloc_hook[jt]+0x1b8 prep_new_page+0x28 get_page_from_freelist+0x1edc __alloc_pages_noprof+0x13c alloc_slab_page+0x244 allocate_slab+0x7c ___slab_alloc+0x8e8 kmem_cache_alloc_noprof+0x450 debug_objects_fill_pool+0x22c debug_object_activate+0x40 enqueue_hrtimer[jt]+0xdc hrtimer_start_range_ns+0x5f8 ...\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39844\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm: move page table sync declarations to linux/pgtable.h During our internal testing, we started observing intermittent boot failures when the machine uses 4-level paging and has a large amount of persistent memory: BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] It turns out that the kernel panics while initializing vmemmap (struct page array) when the vmemmap region spans two PGD entries, because the new PGD entry is only installed in init_mm.pgd, but not in the page tables of other tasks. And looking at __populate_section_memmap(): if (vmemmap_can_optimize(altmap, pgmap)) // does not sync top level page tables r = vmemmap_populate_compound_pages(pfn, start, end, nid, pgmap); else // sync top level page tables in x86 r = vmemmap_populate(start, end, nid, altmap); In the normal path, vmemmap_populate() in arch/x86/mm/init_64.c synchronizes the top level page table (See commit 9b861528a801 (\"x86-64, mem: Update all PGDs for direct mapping and vmemmap mapping changes\")) so that all tasks in the system can see the new vmemmap area. However, when vmemmap_can_optimize() returns true, the optimized path skips synchronization of top-level page tables. This is because vmemmap_populate_compound_pages() is implemented in core MM code, which does not handle synchronization of the top-level page tables. Instead, the core MM has historically relied on each architecture to perform this synchronization manually. We're not the first party to encounter a crash caused by not-sync'd top level page tables: earlier this year, Gwan-gyeong Mun attempted to address the issue [1] [2] after hitting a kernel panic when x86 code accessed the vmemmap area before the corresponding top-level entries were synced. At that time, the issue was believed to be triggered only when struct page was enlarged for debugging purposes, and the patch did not get further updates. It turns out that current approach of relying on each arch to handle the page table sync manually is fragile because 1) it's easy to forget to sync the top level page table, and 2) it's also easy to overlook that the kernel should not access the vmemmap and direct mapping areas before the sync. # The solution: Make page table sync more code robust and harder to miss To address this, Dave Hansen suggested [3] [4] introducing {pgd,p4d}_populate_kernel() for updating kernel portion of the page tables and allow each architecture to explicitly perform synchronization when installing top-level entries. With this approach, we no longer need to worry about missing the sync step, reducing the risk of future regressions. The new interface reuses existing ARCH_PAGE_TABLE_SYNC_MASK, PGTBL_P*D_MODIFIED and arch_sync_kernel_mappings() facility used by vmalloc and ioremap to synchronize page tables. pgd_populate_kernel() looks like this: static inline void pgd_populate_kernel(unsigned long addr, pgd_t *pgd, p4d_t *p4d) { pgd_populate(&init_mm, pgd, p4d); if (ARCH_PAGE_TABLE_SYNC_MASK & PGTBL_PGD_MODIFIED) arch_sync_kernel_mappings(addr, addr); } It is worth noting that vmalloc() and apply_to_range() carefully synchronizes page tables by calling p*d_alloc_track() and arch_sync_kernel_mappings(), and thus they are not affected by ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39845\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() Define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to ensure page tables are properly synchronized when calling p*d_populate_kernel(). For 5-level paging, synchronization is performed via pgd_populate_kernel(). In 4-level paging, pgd_populate() is a no-op, so synchronization is instead performed at the P4D level via p4d_populate_kernel(). This fixes intermittent boot failures on systems using 4-level paging and a large amount of persistent memory: BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] It also fixes a crash in vmemmap_set_pmd() caused by accessing vmemmap before sync_global_pgds() [1]: BUG: unable to handle page fault for address: ffffeb3ff1200000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: Oops: 0002 [#1] PREEMPT SMP NOPTI Tainted: [W]=WARN RIP: 0010:vmemmap_set_pmd+0xff/0x230 vmemmap_populate_hugepages+0x176/0x180 vmemmap_populate+0x34/0x80 __populate_section_memmap+0x41/0x90 sparse_add_section+0x121/0x3e0 __add_pages+0xba/0x150 add_pages+0x1d/0x70 memremap_pages+0x3dc/0x810 devm_memremap_pages+0x1c/0x60 xe_devm_add+0x8b/0x100 [xe] xe_tile_init_noalloc+0x6a/0x70 [xe] xe_device_probe+0x48c/0x740 [xe] [... snip ...]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39846\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() In __iodyn_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource(). Fix this bug by adding a check of res.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39847\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ppp: fix memory leak in pad_compress_skb If alloc_skb() fails in pad_compress_skb(), it returns NULL without releasing the old skb. The caller does: skb = pad_compress_skb(ppp, skb); if (!skb) goto drop; drop: kfree_skb(skb); When pad_compress_skb() returns NULL, the reference to the old skb is lost and kfree_skb(skb) ends up doing nothing, leading to a memory leak. Align pad_compress_skb() semantics with realloc(): only free the old skb if allocation and compression succeed. At the call site, use the new_skb variable so the original skb is not lost when pad_compress_skb() fails.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-772 Missing Release of Resource after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39848\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d (\"net: introduce per netns packet chains\"). skb->dev becomes NULL and we crash in __netif_receive_skb_core(). Before above commit, different kind of bugs or corruptions could happen without a major crash. But the root cause is that ax25_kiss_rcv() can queue/mangle input skb without checking if this skb is shared or not. Many thanks to Bernard Pidoux for his help, diagnosis and tests. We had a similar issue years ago fixed with commit 7aaed57c5c28 (\"phonet: properly unshare skbs in phonet_rcv()\").\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39849\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checking.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39853\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. Fix this by using list_first_entry_or_null instead of list_first_entry.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39857\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G OE 6.17.0-rc2+ #9 NONE Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Workqueue: smc_hs_wq smc_listen_work [smc] RIP: 0010:smc_ib_is_sg_need_sync+0x9e/0xd0 [smc] ... Call Trace: smcr_buf_map_link+0x211/0x2a0 [smc] __smc_buf_create+0x522/0x970 [smc] smc_buf_create+0x3a/0x110 [smc] smc_find_rdma_v2_device_serv+0x18f/0x240 [smc] ? smc_vlan_by_tcpsk+0x7e/0xe0 [smc] smc_listen_find_device+0x1dd/0x2b0 [smc] smc_listen_work+0x30f/0x580 [smc] process_one_work+0x18c/0x340 worker_thread+0x242/0x360 kthread+0xe7/0x220 ret_from_fork+0x13a/0x160 ret_from_fork_asm+0x1a/0x30 If the software RoCE device is used, ibdev->dma_device is a null pointer. As a result, the problem occurs. Null pointer detection is added to prevent problems.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39860\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the \"Freed by task\" part. Let's call l2cap_sock_cleanup_listen() under lock_sock() in l2cap_sock_release(). [0]: BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 Read of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995 CPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 spin_lock_bh include/linux/spinlock.h:356 [inline] release_sock+0x21/0x220 net/core/sock.c:3746 bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2accf8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f R10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c R13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490 Allocated by task 5326: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4365 [inline] __kmalloc_nopro ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39864\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f (\"cfg80211: track hidden SSID networks properly\"), adjust cfg80211_update_known_bss() to free the last beacon frame elements only if they're not shared via the corresponding 'hidden_beacon_bss' pointer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39865\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer dereference in tee_shm_put tee_shm_put have NULL pointer dereference: __optee_disable_shm_cache --> shm = reg_pair_to_ptr(...);//shm maybe return NULL tee_shm_free(shm); --> tee_shm_put(shm);//crash Add check in tee_shm_put to fix it. panic log: Unable to handle kernel paging request at virtual address 0000000000100cca Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 [0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- 6.6.0-39-generic #38 Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 10/26/2022 pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tee_shm_put+0x24/0x188 lr : tee_shm_free+0x14/0x28 sp : ffff001f98f9faf0 x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca Call trace: tee_shm_put+0x24/0x188 tee_shm_free+0x14/0x28 __optee_disable_shm_cache+0xa8/0x108 optee_shutdown+0x28/0x38 platform_shutdown+0x28/0x40 device_shutdown+0x144/0x2b0 kernel_power_off+0x3c/0x80 hibernate+0x35c/0x388 state_store+0x64/0x80 kobj_attr_store+0x14/0x28 sysfs_kf_write+0x48/0x60 kernfs_fop_write_iter+0x128/0x1c0 vfs_write+0x270/0x370 ksys_write+0x6c/0x100 __arm64_sys_write+0x20/0x30 invoke_syscall+0x4c/0x120 el0_svc_common.constprop.0+0x44/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x24/0x88 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x14c/0x15\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39866\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mark_inode_dirty+0x124/0x418 lr : __mark_inode_dirty+0x118/0x418 sp : ffffffc08c9dbbc0 ........ Call trace: __mark_inode_dirty+0x124/0x418 generic_update_time+0x4c/0x60 file_modified+0xcc/0xd0 ext4_buffered_write_iter+0x58/0x124 ext4_file_write_iter+0x54/0x704 vfs_write+0x1c0/0x308 ksys_write+0x74/0x10c __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x40/0xe4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x194/0x198 Root cause is: systemd-random-seed kworker ---------------------------------------------------------------------- ___mark_inode_dirty inode_switch_wbs_work_fn spin_lock(&inode->i_lock); inode_attach_wb locked_inode_to_wb_and_lock_list get inode->i_wb spin_unlock(&inode->i_lock); spin_lock(&wb->list_lock) spin_lock(&inode->i_lock) inode_io_list_move_locked spin_unlock(&wb->list_lock) spin_unlock(&inode->i_lock) spin_lock(&old_wb->list_lock) inode_do_switch_wbs spin_lock(&inode->i_lock) inode->i_wb = new_wb spin_unlock(&inode->i_lock) spin_unlock(&old_wb->list_lock) wb_put_many(old_wb, nr_switched) cgwb_release old wb released wb_wakeup_delayed() accesses wb, then trigger the use-after-free issue Fix this race condition by holding inode spinlock until wb_wakeup_delayed() finished.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-40300\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest. Userspace can additionally be protected by flushing the branch predictors after a VMexit. Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and userspace will incur the most overhead from the new IBPB. This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is doubled up: one at context switch and another before running userspace. The intent is to integrate and optimize these cases post-embargo. [ dhansen: elaborate on suboptimal IBPB solution ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-43368\n<div class=\"csaf-accordion-content\">\n\nA use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-47219\n<div class=\"csaf-accordion-content\">\n\nIn GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n8.1\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-48989\n<div class=\"csaf-accordion-content\">\n\nImproper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-404 Improper Resource Shutdown or Release\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-53057\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-284 Improper Access Control\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-53066\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-55752\n<div class=\"csaf-accordion-content\">\n\nRelative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-23 Relative Path Traversal\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-55754\n<div class=\"csaf-accordion-content\">\n\nImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n9.6\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-61748\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-284 Improper Access Control\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.7\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-61795\n<div class=\"csaf-accordion-content\">\n\nImproper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-404 Improper Resource Shutdown or Release\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-2673\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21925\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.8\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21932\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.4\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21933\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.1\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21945\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-400 Uncontrolled Resource Consumption\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21947\n<div class=\"csaf-accordion-content\">\n\nVulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.1\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-22924\n<div class=\"csaf-accordion-content\">\n\nThe affected application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion conditions. This could allow an attacker to disrupt normal operations or perform unauthorized actions, potentially impacting system availability and integrity.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-306 Missing Authentication for Critical Function\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n9.1\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-22925\n<div class=\"csaf-accordion-content\">\n\nThe affected application is susceptible to resource exhaustion when subjected to high volume of TCP SYN packets This could allow an attacker to render the service unavailable and cause denial-of-service conditions by overwhelming system resources.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28387\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage. By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable. The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records. No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28388\n<div class=\"csaf-accordion-content\">\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28389\n<div class=\"csaf-accordion-content\">\n\nIssue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28390\n<div class=\"csaf-accordion-content\">\n\nIssue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-31789\n<div class=\"csaf-accordion-content\">\n\nIssue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the size of the buffer needed for the result is calculated as multiplication of the input length by 3. On 32 bit platforms, this multiplication may overflow resulting in the allocation of a smaller buffer and a heap buffer overflow. Applications and services that print or log contents of untrusted X.509 certificates are vulnerable to this issue. As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-31790\n<div class=\"csaf-accordion-content\">\n\nIssue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-754 Improper Check for Unusual or Exceptional Conditions\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n</div>\n\n\n\nAcknowledgments\n\n\n\nSiemens ProductCERT reported these vulnerabilities to CISA.\n\n\n\n\nGeneral Recommendations\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\n\n\nAdditional Resources\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories\n\n\n\nTerms of Use\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.\n\n\n\nLegal Notice and Terms of Use\n\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).\n\n\n\nRecommended Practices\n\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.\n\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.\n\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.\n\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.\n\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\n\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\n\n\n\nAdvisory Conversion Disclaimer\n\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-032379 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.\n\nRevision History\n\n\n\nInitial Release Date: 2026-05-12\n\n\n\n\n\nDate\nRevision\nSummary\n\n\n\n\n2026-05-12\n1\nPublication Date\n\n\n2026-05-14\n2\nInitial CISA Republication of Siemens ProductCERT SSA-032379 advisory\n\n\n\n\n\n\nLegal Notice and Terms of Use", "creation_timestamp": "2026-05-14T10:00:00.000000Z"}, {"uuid": "5a1862dd-d055-41c8-bba0-75de3db58143", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28389", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10", "content": "View CSAF\n\nSummary\n\nSIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.\n\nThe following versions of Siemens SIMATIC are affected:\n\n\n\nSIMATIC CN 4100 vers:intdot/<5.0 \n\n<div class=\"csaf-table\">\n\n\n\n\nCVSS\nVendor\nEquipment\nVulnerabilities\n\n\n\n\nv3 9.6\nSiemens\nSiemens SIMATIC\nNULL Pointer Dereference, Reachable Assertion, Use After Free, Out-of-bounds Write, Integer Overflow or Wraparound, Allocation of Resources Without Limits or Throttling, Out-of-bounds Read, Covert Timing Channel, Stack-based Buffer Overflow, Inefficient Algorithmic Complexity, Missing Release of Memory after Effective Lifetime, Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Input Validation, Improper Locking, Uncontrolled Recursion, Buffer Access with Incorrect Length Value, Race Condition within a Thread, Missing Synchronization, Use of Uninitialized Resource, Double Free, Missing Release of Resource after Effective Lifetime, Loop with Unreachable Exit Condition ('Infinite Loop'), Improper Update of Reference Count, Improper Control of a Resource Through its Lifetime, Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), Unexpected Status Code or Return Value, Divide By Zero, Improper Validation of Specified Index, Position, or Offset in Input, Comparison Using Wrong Factors, Observable Timing Discrepancy, Improper Validation of Syntactic Correctness of Input, Deadlock, Signal Handler Race Condition, Improper Following of Specification by Caller, Improper Check for Dropped Privileges, Transmission of Private Resources into a New Sphere ('Resource Leak'), Improper Resource Shutdown or Release, Improper Access Control, Exposure of Sensitive Information to an Unauthorized Actor, Relative Path Traversal, Improper Neutralization of Escape, Meta, or Control Sequences, Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade'), Uncontrolled Resource Consumption, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Missing Authentication for Critical Function, Improper Check for Unusual or Exceptional Conditions\n\n\n\n</div>\n\nBackground\n\n\n\nCritical Infrastructure Sectors: Critical Manufacturing\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: Germany\n\n\n\n\nVulnerabilities\n<div class=\"csaf-accordion\">\n\nExpand All +\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-47704\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check link_res->hpo_dp_link_enc before using it [WHAT & HOW] Functions dp_enable_link_phy and dp_disable_link_phy can pass link_res without initializing hpo_dp_link_enc and it is necessary to check for null before dereferencing. This fixes 2 FORWARD_NULL issues reported by Coverity.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-57924\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding file handles is usually performed by a filesystem >encode_fh() method that may fail for various reasons. The legacy users of exportfs_encode_fh(), namely, nfsd and name_to_handle_at(2) syscall are ready to cope with the possibility of failure to encode a file handle. There are a few other users of exportfs_encode_{fh,fid}() that currently have a WARN_ON() assertion when ->encode_fh() fails. Relax those assertions because they are wrong. The second linked bug report states commit 16aac5ad1fa9 (\"ovl: support encoding non-decodable file handles\") in v6.6 as the regressing commit, but this is not accurate. The aforementioned commit only increases the chances of the assertion and allows triggering the assertion with the reproducer using overlayfs, inotify and drop_caches. Triggering this assertion was always possible with other filesystems and other reasons of ->encode_fh() failures and more particularly, it was also possible with the exact same reproducer using overlayfs that is mounted with options index=on,nfs_export=on also on kernels < v6.6. Therefore, I am not listing the aforementioned commit as a Fixes commit. Backport hint: this patch will have a trivial conflict applying to v6.6.y, and other trivial conflicts applying to stable kernels < v6.6.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-617 Reachable Assertion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-58240\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result. We should preferably also use a separate crypto_wait. I'm not seeing a UAF as I did in the past, I think aec7961916f3 (\"tls: fix race between async notify and socket close\") took care of it. This will make the next fix easier.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.3\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-6021\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-6052\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in how GLib\u2019s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn\u2019t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-190 Integer Overflow or Wraparound\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.7\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-7425\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-8916\n<div class=\"csaf-accordion-content\">\n\nAllocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9230\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9231\n<div class=\"csaf-accordion-content\">\n\nIssue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is possible to add support for such certificates via a custom provider, coupled with the fact that in such a custom provider context the private key may be recoverable via remote timing measurements, we consider this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as SM2 is not an approved algorithm.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-385 Covert Timing Channel\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9232\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9820\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-121 Stack-based Buffer Overflow\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-14831\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-407 Inefficient Algorithmic Complexity\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-23143\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. When I ran the repro [0] and waited a few seconds, I observed two LOCKDEP splats: a warning immediately followed by a null-ptr-deref. [1] Reproduction Steps: 1) Mount CIFS 2) Add an iptables rule to drop incoming FIN packets for CIFS 3) Unmount CIFS 4) Unload the CIFS module 5) Remove the iptables rule At step 3), the CIFS module calls sock_release() for the underlying TCP socket, and it returns quickly. However, the socket remains in FIN_WAIT_1 because incoming FIN packets are dropped. At this point, the module's refcnt is 0 while the socket is still alive, so the following rmmod command succeeds. # ss -tan State Recv-Q Send-Q Local Address:Port Peer Address:Port FIN-WAIT-1 0 477 10.0.2.15:51062 10.0.0.137:445 # lsmod | grep cifs cifs 1159168 0 This highlights a discrepancy between the lifetime of the CIFS module and the underlying TCP socket. Even after CIFS calls sock_release() and it returns, the TCP socket does not die immediately in order to close the connection gracefully. While this is generally fine, it causes an issue with LOCKDEP because CIFS assigns a different lock class to the TCP socket's sk->sk_lock using sock_lock_init_class_and_name(). Once an incoming packet is processed for the socket or a timer fires, sk->sk_lock is acquired. Then, LOCKDEP checks the lock context in check_wait_context(), where hlock_class() is called to retrieve the lock class. However, since the module has already been unloaded, hlock_class() logs a warning and returns NULL, triggering the null-ptr-deref. If LOCKDEP is enabled, we must ensure that a module calling sock_lock_init_class_and_name() (CIFS, NFS, etc) cannot be unloaded while such a socket is still alive to prevent this issue. Let's hold the module reference in sock_lock_init_class_and_name() and release it when the socket is freed in sk_prot_free(). Note that sock_lock_init() clears sk->sk_owner for svc_create_socket() that calls sock_lock_init_class_and_name() for a listening socket, which clones a socket by sk_clone_lock() without GFP_ZERO. [0]: CIFS_SERVER=\"10.0.0.137\" CIFS_PATH=\"//${CIFS_SERVER}/Users/Administrator/Desktop/CIFS_TEST\" DEV=\"enp0s3\" CRED=\"/root/WindowsCredential.txt\" MNT=$(mktemp -d /tmp/XXXXXX) mount -t cifs ${CIFS_PATH} ${MNT} -o vers=3.0,credentials=${CRED},cache=none,echo_interval=1 iptables -A INPUT -s ${CIFS_SERVER} -j DROP for i in $(seq 10); do umount ${MNT} rmmod cifs sleep 1 done rm -r ${MNT} iptables -D INPUT -s ${CIFS_SERVER} -j DROP [1]: DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 10 PID: 0 at kernel/locking/lockdep.c:234 hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223) Modules linked in: cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs] CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Not tainted 6.14.0 #36 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223) ... Call Trace: __lock_acquire (kernel/locking/lockdep.c:4853 kernel/locking/lockdep.c:5178) lock_acquire (kernel/locking/lockdep.c:469 kernel/locking/lockdep.c:5853 kernel/locking/lockdep.c:5816) _raw_spin_lock_nested (kernel/locking/spinlock.c:379) tcp_v4_rcv (./include/linux/skbuff.h:1678 ./include/net/tcp.h:2547 net/ipv4/tcp_ipv4.c:2350) ... BUG: kernel NULL pointer dereference, address: 00000000000000c4 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Tainted: G W 6.14.0 #36 Tainted: [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__lock_acquire (kernel/ ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-23160\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization On Mediatek devices with a system companion processor (SCP) the mtk_scp structure has to be removed explicitly to avoid a resource leak. Free the structure in case the allocation of the firmware structure fails during the firmware initialization.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-31257\n<div class=\"csaf-accordion-content\">\n\nThis issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-37931\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: adjust subpage bit start based on sectorsize When running machines with 64k page size and a 16k nodesize we started seeing tree log corruption in production. This turned out to be because we were not writing out dirty blocks sometimes, so this in fact affects all metadata writes. When writing out a subpage EB we scan the subpage bitmap for a dirty range. If the range isn't dirty we do bit_start++; to move onto the next bit. The problem is the bitmap is based on the number of sectors that an EB has. So in this case, we have a 64k pagesize, 16k nodesize, but a 4k sectorsize. This means our bitmap is 4 bits for every node. With a 64k page size we end up with 4 nodes per page. To make this easier this is how everything looks [0 16k 32k 48k ] logical address [0 4 8 12 ] radix tree offset [ 64k page ] folio [ 16k eb ][ 16k eb ][ 16k eb ][ 16k eb ] extent buffers [ | | | | | | | | | | | | | | | | ] bitmap Now we use all of our addressing based on fs_info->sectorsize_bits, so as you can see the above our 16k eb->start turns into radix entry 4. When we find a dirty range for our eb, we correctly do bit_start += sectors_per_node, because if we start at bit 0, the next bit for the next eb is 4, to correspond to eb->start 16k. However if our range is clean, we will do bit_start++, which will now put us offset from our radix tree entries. In our case, assume that the first time we check the bitmap the block is not dirty, we increment bit_start so now it == 1, and then we loop around and check again. This time it is dirty, and we go to find that start using the following equation start = folio_start + bit_start * fs_info->sectorsize; so in the case above, eb->start 0 is now dirty, and we calculate start as 0 + 1 * fs_info->sectorsize = 4096 4096 >> 12 = 1 Now we're looking up the radix tree for 1, and we won't find an eb. What's worse is now we're using bit_start == 1, so we do bit_start += sectors_per_node, which is now 5. If that eb is dirty we will run into the same thing, we will look at an offset that is not populated in the radix tree, and now we're skipping the writeout of dirty extent buffers. The best fix for this is to not use sectorsize_bits to address nodes, but that's a larger change. Since this is a fs corruption problem fix it simply by always using sectors_per_node to increment the start bit.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-37968\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: light: opt3001: fix deadlock due to concurrent flag access The threaded IRQ function in this driver is reading the flag twice: once to lock a mutex and once to unlock it. Even though the code setting the flag is designed to prevent it, there are subtle cases where the flag could be true at the mutex_lock stage and false at the mutex_unlock stage. This results in the mutex not being unlocked, resulting in a deadlock. Fix it by making the opt3001_irq() code generally more robust, reading the flag into a variable and using the variable value at both stages.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38322\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Hardware name: Dell Inc. Precision 9660/0VJ762 RIP: 0010:native_read_pmc+0x7/0x40 Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP: 000:fffb03100273de8 EFLAGS: 00010046 .... Call Trace: icl_update_topdown_event+0x165/0x190 ? ktime_get+0x38/0xd0 intel_pmu_read_event+0xf9/0x210 __perf_event_read+0xf9/0x210 CPUs 16-23 are E-core CPUs that don't support the perf metrics feature. The icl_update_topdown_event() should not be invoked on these CPUs. It's a regression of commit: f9bdf1f95339 (\"perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read\") The bug introduced by that commit is that the is_topdown_event() function is mistakenly used to replace the is_topdown_count() call to check if the topdown functions for the perf metrics feature should be invoked. Fix it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38347\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on ino and xnid syzbot reported a f2fs bug as below: INFO: task syz-executor140:5308 blocked for more than 143 seconds. Not tainted 6.14.0-rc7-syzkaller-00069-g81e4f8d68c66 #0 \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message. task:syz-executor140 state:D stack:24016 pid:5308 tgid:5308 ppid:5306 task_flags:0x400140 flags:0x00000006 Call Trace: context_switch kernel/sched/core.c:5378 [inline] __schedule+0x190e/0x4c90 kernel/sched/core.c:6765 __schedule_loop kernel/sched/core.c:6842 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6857 io_schedule+0x8d/0x110 kernel/sched/core.c:7690 folio_wait_bit_common+0x839/0xee0 mm/filemap.c:1317 __folio_lock mm/filemap.c:1664 [inline] folio_lock include/linux/pagemap.h:1163 [inline] __filemap_get_folio+0x147/0xb40 mm/filemap.c:1917 pagecache_get_page+0x2c/0x130 mm/folio-compat.c:87 find_get_page_flags include/linux/pagemap.h:842 [inline] f2fs_grab_cache_page+0x2b/0x320 fs/f2fs/f2fs.h:2776 __get_node_page+0x131/0x11b0 fs/f2fs/node.c:1463 read_xattr_block+0xfb/0x190 fs/f2fs/xattr.c:306 lookup_all_xattrs fs/f2fs/xattr.c:355 [inline] f2fs_getxattr+0x676/0xf70 fs/f2fs/xattr.c:533 __f2fs_get_acl+0x52/0x870 fs/f2fs/acl.c:179 f2fs_acl_create fs/f2fs/acl.c:375 [inline] f2fs_init_acl+0xd7/0x9b0 fs/f2fs/acl.c:418 f2fs_init_inode_metadata+0xa0f/0x1050 fs/f2fs/dir.c:539 f2fs_add_inline_entry+0x448/0x860 fs/f2fs/inline.c:666 f2fs_add_dentry+0xba/0x1e0 fs/f2fs/dir.c:765 f2fs_do_add_link+0x28c/0x3a0 fs/f2fs/dir.c:808 f2fs_add_link fs/f2fs/f2fs.h:3616 [inline] f2fs_mknod+0x2e8/0x5b0 fs/f2fs/namei.c:766 vfs_mknod+0x36d/0x3b0 fs/namei.c:4191 unix_bind_bsd net/unix/af_unix.c:1286 [inline] unix_bind+0x563/0xe30 net/unix/af_unix.c:1379 __sys_bind_socket net/socket.c:1817 [inline] __sys_bind+0x1e4/0x290 net/socket.c:1848 __do_sys_bind net/socket.c:1853 [inline] __se_sys_bind net/socket.c:1851 [inline] __x64_sys_bind+0x7a/0x90 net/socket.c:1851 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Let's dump and check metadata of corrupted inode, it shows its xattr_nid is the same to its i_ino. dump.f2fs -i 3 chaseyu.img.raw i_xattr_nid [0x 3 : 3] So that, during mknod in the corrupted directory, it tries to get and lock inode page twice, result in deadlock. - f2fs_mknod - f2fs_add_inline_entry - f2fs_get_inode_page --- lock dir's inode page - f2fs_init_acl - f2fs_acl_create(dir,..) - __f2fs_get_acl - f2fs_getxattr - lookup_all_xattrs - __get_node_page --- try to lock dir's inode page In order to fix this, let's add sanity check on ino and xnid.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38491\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mptcp: make fallback action and fallback decision atomic Syzkaller reported the following splat: WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 check_fully_established net/mptcp/options.c:982 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Modules linked in: CPU: 1 UID: 0 PID: 7704 Comm: syz.3.1419 Not tainted 6.16.0-rc3-gbd5ce2324dba #20 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] RIP: 0010:mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] RIP: 0010:check_fully_established net/mptcp/options.c:982 [inline] RIP: 0010:mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Code: 24 18 e8 bb 2a 00 fd e9 1b df ff ff e8 b1 21 0f 00 e8 ec 5f c4 fc 44 0f b7 ac 24 b0 00 00 00 e9 54 f1 ff ff e8 d9 5f c4 fc 90 <0f> 0b 90 e9 b8 f4 ff ff e8 8b 2a 00 fd e9 8d e6 ff ff e8 81 2a 00 RSP: 0018:ffff8880a3f08448 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880180a8000 RCX: ffffffff84afcf45 RDX: ffff888090223700 RSI: ffffffff84afdaa7 RDI: 0000000000000001 RBP: ffff888017955780 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880180a8910 R14: ffff8880a3e9d058 R15: 0000000000000000 FS: 00005555791b8500(0000) GS:ffff88811c495000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c2800b7 CR3: 0000000058e44000 CR4: 0000000000350ef0 Call Trace: tcp_reset+0x26f/0x2b0 net/ipv4/tcp_input.c:4432 tcp_validate_incoming+0x1057/0x1b60 net/ipv4/tcp_input.c:5975 tcp_rcv_established+0x5b5/0x21f0 net/ipv4/tcp_input.c:6166 tcp_v4_do_rcv+0x5dc/0xa70 net/ipv4/tcp_ipv4.c:1925 tcp_v4_rcv+0x3473/0x44a0 net/ipv4/tcp_ipv4.c:2363 ip_protocol_deliver_rcu+0xba/0x480 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2f1/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_local_deliver+0x1be/0x560 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:469 [inline] ip_rcv_finish net/ipv4/ip_input.c:447 [inline] NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_rcv+0x514/0x810 net/ipv4/ip_input.c:567 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5975 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6088 process_backlog+0x301/0x1360 net/core/dev.c:6440 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7453 napi_poll net/core/dev.c:7517 [inline] net_rx_action+0xb44/0x1010 net/core/dev.c:7644 handle_softirqs+0x1d0/0x770 kernel/softirq.c:579 do_softirq+0x3f/0x90 kernel/softirq.c:480 __local_bh_enable_ip+0xed/0x110 kernel/softirq.c:407 local_bh_enable include/linux/bottom_half.h:33 [inline] inet_csk_listen_stop+0x2c5/0x1070 net/ipv4/inet_connection_sock.c:1524 mptcp_check_listen_stop.part.0+0x1cc/0x220 net/mptcp/protocol.c:2985 mptcp_check_listen_stop net/mptcp/mib.h:118 [inline] __mptcp_close+0x9b9/0xbd0 net/mptcp/protocol.c:3000 mptcp_close+0x2f/0x140 net/mptcp/protocol.c:3066 inet_release+0xed/0x200 net/ipv4/af_inet.c:435 inet6_release+0x4f/0x70 net/ipv6/af_inet6.c:487 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x402/0xb70 fs/file_table.c:465 task_work_run+0x150/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xd4 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38502\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: bpf: Fix oob access in cgroup local storage Lonial reported that an out-of-bounds access in cgroup local storage can be crafted via tail calls. Given two programs each utilizing a cgroup local storage with a different value size, and one program doing a tail call into the other. The verifier will validate each of the indivial programs just fine. However, in the runtime context the bpf_cg_run_ctx holds an bpf_prog_array_item which contains the BPF program as well as any cgroup local storage flavor the program uses. Helpers such as bpf_get_local_storage() pick this up from the runtime context: ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx); storage = ctx->prog_item->cgroup_storage[stype]; if (stype == BPF_CGROUP_STORAGE_SHARED) ptr = &READ_ONCE(storage->buf)->data[0]; else ptr = this_cpu_ptr(storage->percpu_buf); For the second program which was called from the originally attached one, this means bpf_get_local_storage() will pick up the former program's map, not its own. With mismatching sizes, this can result in an unintended out-of-bounds access. To fix this issue, we need to extend bpf_map_owner with an array of storage_cookie[] to match on i) the exact maps from the original program if the second program was using bpf_get_local_storage(), or ii) allow the tail call combination if the second program was not using any of the cgroup local storage maps.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38552\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between subflow fail and subflow creation We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are just harder to trigger. The solution is similar. Use a separate flag to track the condition 'socket state prevent any additional subflow creation' protected by the fallback lock. The socket fallback makes such flag true, and also receiving or sending an MP_FAIL option. The field 'allow_infinite_fallback' is now always touched under the relevant lock, we can drop the ONCE annotation on write.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38614\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the depth of the resulting tree for two reasons: - They don't look upwards in the tree. - If there are multiple downwards paths of different lengths, only one of the paths is actually considered for the depth check since commit 28d82dc1c4ed (\"epoll: limit paths\"). Essentially, the current recursion depth check in ep_loop_check_proc() just serves to prevent it from recursing too deeply while checking for loops. A more thorough check is done in reverse_path_check() after the new graph edge has already been created; this checks, among other things, that no paths going upwards from any non-epoll file with a length of more than 5 edges exist. However, this check does not apply to non-epoll files. As a result, it is possible to recurse to a depth of at least roughly 500, tested on v6.15. (I am unsure if deeper recursion is possible; and this may have changed with commit 8c44dac8add7 (\"eventpoll: Fix priority inversion problem\").) To fix it: 1. In ep_loop_check_proc(), note the subtree depth of each visited node, and use subtree depths for the total depth calculation even when a subtree has already been visited. 2. Add ep_get_upwards_depth_proc() for similarly determining the maximum depth of an upwards walk. 3. In ep_loop_check(), use these values to limit the total path length between epoll nodes to EP_MAX_NESTS edges.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-674 Uncontrolled Recursion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38670\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() `cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change to different stacks along with the Shadow Call Stack if it is enabled. Those two stack changes cannot be done atomically and both functions can be interrupted by SErrors or Debug Exceptions which, though unlikely, is very much broken : if interrupted, we can end up with mismatched stacks and Shadow Call Stack leading to clobbered stacks. In `cpu_switch_to()`, it can happen when SP_EL0 points to the new task, but x18 stills points to the old task's SCS. When the interrupt handler tries to save the task's SCS pointer, it will save the old task SCS pointer (x18) into the new task struct (pointed to by SP_EL0), clobbering it. In `call_on_irq_stack()`, it can happen when switching from the task stack to the IRQ stack and when switching back. In both cases, we can be interrupted when the SCS pointer points to the IRQ SCS, but SP points to the task stack. The nested interrupt handler pushes its return addresses on the IRQ SCS. It then detects that SP points to the task stack, calls `call_on_irq_stack()` and clobbers the task SCS pointer with the IRQ SCS pointer, which it will also use ! This leads to tasks returning to addresses on the wrong SCS, or even on the IRQ SCS, triggering kernel panics via CONFIG_VMAP_STACK or FPAC if enabled. This is possible on a default config, but unlikely. However, when enabling CONFIG_ARM64_PSEUDO_NMI, DAIF is unmasked and instead the GIC is responsible for filtering what interrupts the CPU should receive based on priority. Given the goal of emulating NMIs, pseudo-NMIs can be received by the CPU even in `cpu_switch_to()` and `call_on_irq_stack()`, possibly *very* frequently depending on the system configuration and workload, leading to unpredictable kernel panics. Completely mask DAIF in `cpu_switch_to()` and restore it when returning. Do the same in `call_on_irq_stack()`, but restore and mask around the branch. Mask DAIF even if CONFIG_SHADOW_CALL_STACK is not enabled for consistency of behaviour between all configurations. Introduce and use an assembly macro for saving and masking DAIF, as the existing one saves but only masks IF.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38676\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iommu/amd: Avoid stack buffer overflow from kernel cmdline While the kernel command line is considered trusted in most environments, avoid writing 1 byte past the end of \"acpiid\" if the \"str\" argument is maximum length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-805 Buffer Access with Incorrect Length Value\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38677\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-boundary access in dnode page As Jiaming Zhang reported: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x1c1/0x2a0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x17e/0x800 mm/kasan/report.c:480 kasan_report+0x147/0x180 mm/kasan/report.c:593 data_blkaddr fs/f2fs/f2fs.h:3053 [inline] f2fs_data_blkaddr fs/f2fs/f2fs.h:3058 [inline] f2fs_get_dnode_of_data+0x1a09/0x1c40 fs/f2fs/node.c:855 f2fs_reserve_block+0x53/0x310 fs/f2fs/data.c:1195 prepare_write_begin fs/f2fs/data.c:3395 [inline] f2fs_write_begin+0xf39/0x2190 fs/f2fs/data.c:3594 generic_perform_write+0x2c7/0x910 mm/filemap.c:4112 f2fs_buffered_write_iter fs/f2fs/file.c:4988 [inline] f2fs_file_write_iter+0x1ec8/0x2410 fs/f2fs/file.c:5216 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x546/0xa90 fs/read_write.c:686 ksys_write+0x149/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x3d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is in the corrupted image, there is a dnode has the same node id w/ its inode, so during f2fs_get_dnode_of_data(), it tries to access block address in dnode at offset 934, however it parses the dnode as inode node, so that get_dnode_addr() returns 360, then it tries to access page address from 360 + 934 * 4 = 4096 w/ 4 bytes. To fix this issue, let's add sanity check for node id of all direct nodes during f2fs_get_dnode_of_data().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38679\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: Fix OOB read due to missing payload bound check Currently, The event_seq_changed() handler processes a variable number of properties sent by the firmware. The number of properties is indicated by the firmware and used to iterate over the payload. However, the payload size is not being validated against the actual message length. This can lead to out-of-bounds memory access if the firmware provides a property count that exceeds the data available in the payload. Such a condition can result in kernel crashes or potential information leaks if memory beyond the buffer is accessed. Fix this by properly validating the remaining size of the payload before each property access and updating bounds accordingly as properties are parsed. This ensures that property parsing is safely bounded within the received message buffer and protects against malformed or malicious firmware behavior.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38680\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() The buffer length check before calling uvc_parse_format() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 bytes. This can lead to an out-of-bounds read if the buffer has exactly 3 bytes. Fix it by checking that the buffer has at least 4 bytes in uvc_parse_format().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38681\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() Memory hot remove unmaps and tears down various kernel page table regions as required. The ptdump code can race with concurrent modifications of the kernel page tables. When leaf entries are modified concurrently, the dump code may log stale or inconsistent information for a VA range, but this is otherwise not harmful. But when intermediate levels of kernel page table are freed, the dump code will continue to use memory that has been freed and potentially reallocated for another purpose. In such cases, the ptdump code may dereference bogus addresses, leading to a number of potential problems. To avoid the above mentioned race condition, platforms such as arm64, riscv and s390 take memory hotplug lock, while dumping kernel page table via the sysfs interface /sys/kernel/debug/kernel_page_tables. Similar race condition exists while checking for pages that might have been marked W+X via /sys/kernel/debug/kernel_page_tables/check_wx_pages which in turn calls ptdump_check_wx(). Instead of solving this race condition again, let's just move the memory hotplug lock inside generic ptdump_check_wx() which will benefit both the scenarios. Drop get_online_mems() and put_online_mems() combination from all existing platform ptdump code paths.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-366 Race Condition within a Thread\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38683\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, default_device_exit_batch() >> default_device_exit_net() is called. When netvsc NIC is moved back and registered to the default namespace, it automatically brings VF NIC back to the default namespace. This will cause the default_device_exit_net() >> for_each_netdev_safe loop unable to detect the list end, and hit NULL ptr: [ 231.449420] mana 7870:00:00.0 enP30832s1: Moved VF to namespace with: eth0 [ 231.449656] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 231.450246] #PF: supervisor read access in kernel mode [ 231.450579] #PF: error_code(0x0000) - not-present page [ 231.450916] PGD 17b8a8067 P4D 0 [ 231.451163] Oops: Oops: 0000 [#1] SMP NOPTI [ 231.451450] CPU: 82 UID: 0 PID: 1394 Comm: kworker/u768:1 Not tainted 6.16.0-rc4+ #3 VOLUNTARY [ 231.452042] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/21/2024 [ 231.452692] Workqueue: netns cleanup_net [ 231.452947] RIP: 0010:default_device_exit_batch+0x16c/0x3f0 [ 231.453326] Code: c0 0c f5 b3 e8 d5 db fe ff 48 85 c0 74 15 48 c7 c2 f8 fd ca b2 be 10 00 00 00 48 8d 7d c0 e8 7b 77 25 00 49 8b 86 28 01 00 00 <48> 8b 50 10 4c 8b 2a 4c 8d 62 f0 49 83 ed 10 4c 39 e0 0f 84 d6 00 [ 231.454294] RSP: 0018:ff75fc7c9bf9fd00 EFLAGS: 00010246 [ 231.454610] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 61c8864680b583eb [ 231.455094] RDX: ff1fa9f71462d800 RSI: ff75fc7c9bf9fd38 RDI: 0000000030766564 [ 231.455686] RBP: ff75fc7c9bf9fd78 R08: 0000000000000000 R09: 0000000000000000 [ 231.456126] R10: 0000000000000001 R11: 0000000000000004 R12: ff1fa9f70088e340 [ 231.456621] R13: ff1fa9f70088e340 R14: ffffffffb3f50c20 R15: ff1fa9f7103e6340 [ 231.457161] FS: 0000000000000000(0000) GS:ff1faa6783a08000(0000) knlGS:0000000000000000 [ 231.457707] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 231.458031] CR2: 0000000000000010 CR3: 0000000179ab2006 CR4: 0000000000b73ef0 [ 231.458434] Call Trace: [ 231.458600] [ 231.458777] ops_undo_list+0x100/0x220 [ 231.459015] cleanup_net+0x1b8/0x300 [ 231.459285] process_one_work+0x184/0x340 To fix it, move the ns change to a workqueue, and take rtnl_lock to avoid changing the netdev list when default_device_exit_net() is using it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-820 Missing Synchronization\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.2\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38684\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify() after recent changes from Lion [2]. The problem is: in ets_qdisc_change() we purge unused DWRR queues; the value of 'q->nbands' is the new one, and the cleanup should be done with the old one. The problem is here since my first attempts to fix ets_qdisc_change(), but it surfaced again after the recent qdisc len accounting fixes. Fix it purging idle DWRR queues before assigning a new value of 'q->nbands', so that all purge operations find a consistent configuration: - old 'q->nbands' because it's needed by ets_class_find() - old 'q->nstrict' because it's needed by ets_class_is_strict() BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 62 UID: 0 PID: 39457 Comm: tc Kdump: loaded Not tainted 6.12.0-116.el10.x86_64 #1 PREEMPT(voluntary) Hardware name: Dell Inc. PowerEdge R640/06DKY5, BIOS 2.12.2 07/09/2021 RIP: 0010:__list_del_entry_valid_or_report+0x4/0x80 Code: ff 4c 39 c7 0f 84 39 19 8e ff b8 01 00 00 00 c3 cc cc cc cc 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <48> 8b 17 48 8b 4f 08 48 85 d2 0f 84 56 19 8e ff 48 85 c9 0f 84 ab RSP: 0018:ffffba186009f400 EFLAGS: 00010202 RAX: 00000000000000d6 RBX: 0000000000000000 RCX: 0000000000000004 RDX: ffff9f0fa29b69c0 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffffffc12c2400 R08: 0000000000000008 R09: 0000000000000004 R10: ffffffffffffffff R11: 0000000000000004 R12: 0000000000000000 R13: ffff9f0f8cfe0000 R14: 0000000000100005 R15: 0000000000000000 FS: 00007f2154f37480(0000) GS:ffff9f269c1c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001530be001 CR4: 00000000007726f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ets_class_qlen_notify+0x65/0x90 [sch_ets] qdisc_tree_reduce_backlog+0x74/0x110 ets_qdisc_change+0x630/0xa40 [sch_ets] __tc_modify_qdisc.constprop.0+0x216/0x7f0 tc_modify_qdisc+0x7c/0x120 rtnetlink_rcv_msg+0x145/0x3f0 netlink_rcv_skb+0x53/0x100 netlink_unicast+0x245/0x390 netlink_sendmsg+0x21b/0x470 ____sys_sendmsg+0x39d/0x3d0 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xd0 do_syscall_64+0x7d/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f2155114084 Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 25 f0 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 RSP: 002b:00007fff1fd7a988 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000560ec063e5e0 RCX: 00007f2155114084 RDX: 0000000000000000 RSI: 00007fff1fd7a9f0 RDI: 0000000000000003 RBP: 00007fff1fd7aa60 R08: 0000000000000010 R09: 000000000000003f R10: 0000560ee9b3a010 R11: 0000000000000202 R12: 00007fff1fd7aae0 R13: 000000006891ccde R14: 0000560ec063e5e0 R15: 00007fff1fd7aad0 [1] https://lore.kernel.org/netdev/e08c7f4a6882f260011909a868311c6e9b54f3e4.1639153474.git.dcaratti@redhat.com/ [2] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.2\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38685\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible. As part of mapping it has to do resize of console according to frame buffer info. if this resize fails and returns from vc_do_resize() and continues further. At this point console and new frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the screen at later stages where vc_data is related to previous frame buffer and frame buffer info and display vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fast_imageblit(). This bheviour is excepted only when fg_console is equal to requested console which is a visible console and updates screen with invalid struct references in fbcon_putcs().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38687\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the wait_queue_head inside of it. This can cause a use-after-free when the poll entries are later triggered or removed, as the memory for the wait_queue_head has been freed. We need to check there are no tasks queued on any of the subdevices' wait queues before allowing the device to be detached by the `COMEDI_DEVCONFIG` ioctl. Tasks will read-lock `dev->attach_lock` before adding themselves to the subdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl handler by write-locking `dev->attach_lock` before checking that all of the subdevices are safe to be deleted. This includes testing for any sleepers on the subdevices' wait queues. It remains locked until the device has been detached. This requires the `comedi_device_detach()` function to be refactored slightly, moving the bulk of it into new function `comedi_device_detach_locked()`. Note that the refactor of `comedi_device_detach()` results in `comedi_device_cancel_all()` now being called while `dev->attach_lock` is write-locked, which wasn't the case previously, but that does not matter. Thanks to Jens Axboe for diagnosing the problem and co-developing this patch.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38691\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the \"layoutupdate_pages\" page array is initialized only after the retry loop. But ext_tree_free_commitdata() is called on every iteration and tries to put pages in the array, thus dereferencing uninitialized pointers. An additional problem is that there is no limit on the maximum possible buffer_size. When there are too many extents, the client may create a layoutcommit that is larger than the maximum possible RPC size accepted by the server. During testing, we observed two typical scenarios. First, one memory page for extents is enough when we work with small files, append data to the end of the file, or preallocate extents before writing. But when we fill a new large file without preallocating, the number of extents can be huge, and counting the number of written extents in ext_tree_encode_commit() does not help much. Since this number increases even more between unlocking and locking of ext_tree, the reallocated buffer may not be large enough again and again.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-908 Use of Uninitialized Resource\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38693\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar commit: commit 0ed554fd769a (\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38694\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar issue occurs when access msg[1].buf[0] and msg[1].buf[1]. Similar commit: commit 0ed554fd769a (\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38695\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the resultant cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() may occur before sli4_hba.hdwqs are allocated. This may result in a null pointer dereference when attempting to take the abts_io_buf_list_lock for the first hardware queue. Fix by adding a null ptr check on phba->sli4_hba.hdwq and early return because this situation means there must have been an error during port initialization.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38696\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stack_top() for tasks without ABI or vDSO Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL ABI pointer and crash. This can for example happen when using kunit: mips_stack_top+0x28/0xc0 arch_pick_mmap_layout+0x190/0x220 kunit_vm_mmap_init+0xf8/0x138 __kunit_add_resource+0x40/0xa8 kunit_vm_mmap+0x88/0xd8 usercopy_test_init+0xb8/0x240 kunit_try_run_case+0x5c/0x1a8 kunit_generic_run_threadfn_adapter+0x28/0x50 kthread+0x118/0x240 ret_from_kernel_thread+0x14/0x1c Only dereference the ABI point if it is set. The GIC page is also included as it is specific to the vDSO. Also move the randomization adjustment into the same conditional.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38697\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: upper bound check of tree index in dbAllocAG When computing the tree index in dbAllocAG, we never check if we are out of bounds realative to the size of the stree. This could happen in a scenario where the filesystem metadata are corrupted.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38698\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: Regular file corruption check The reproducer builds a corrupted file on disk with a negative i_size value. Add a check when opening this file to avoid subsequent operation failures.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38699\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix When the bfad_im_probe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfad->im to NULL. Subsequently, during driver uninstallation, when the state machine enters the bfad_sm_stopping state and calls the bfad_im_probe_undo() function, it attempts to free the memory pointed to by bfad->im again, thereby triggering a double-free vulnerability. Set bfad->im to NULL if probing fails.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-415 Double Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.4\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38700\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated In case of an ib_fast_reg_mr allocation failure during iSER setup, the machine hits a panic because iscsi_conn->dd_data is initialized unconditionally, even when no memory is allocated (dd_size == 0). This leads invalid pointer dereference during connection teardown. Fix by setting iscsi_conn->dd_data only if memory is actually allocated. Panic trace: ------------ iser: iser_create_fastreg_desc: Failed to allocate ib_fast_reg_mr err=-12 iser: iser_alloc_rx_descriptors: failed allocating rx descriptors / data buffers BUG: unable to handle page fault for address: fffffffffffffff8 RIP: 0010:swake_up_locked.part.5+0xa/0x40 Call Trace: complete+0x31/0x40 iscsi_iser_conn_stop+0x88/0xb0 [ib_iser] iscsi_stop_conn+0x66/0xc0 [scsi_transport_iscsi] iscsi_if_stop_conn+0x14a/0x150 [scsi_transport_iscsi] iscsi_if_rx+0x1135/0x1834 [scsi_transport_iscsi] ? netlink_lookup+0x12f/0x1b0 ? netlink_deliver_tap+0x2c/0x200 netlink_unicast+0x1ab/0x280 netlink_sendmsg+0x257/0x4f0 ? _copy_from_user+0x29/0x60 sock_sendmsg+0x5f/0x70\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38701\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missing the system.data extended attribute. Since this can happen due to a maiciouly fuzzed file system, we shouldn't BUG, but rather, report it as a corrupted file system. Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii ext4_create_inline_data() and ext4_inline_data_truncate().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-617 Reachable Assertion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38702\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer overflow in do_register_framebuffer() The current implementation may lead to buffer overflow when: 1. Unregistration creates NULL gaps in registered_fb[] 2. All array slots become occupied despite num_registered_fb < FB_MAX 3. The registration loop exceeds array bounds Add boundary check to prevent registered_fb[FB_MAX] access.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38706\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on the system. On module removal the soc_tplg_remove_link() would call snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored, no runtime was created.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38707\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for file name The length of the file name should be smaller than the directory entry size.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38708\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD tries to detect \"concurrent\" writes and handle write conflicts, so that even if you write to the same sector simultaneously on both nodes, they end up with the identical data once the writes are completed. In handling \"superseeded\" writes, we forgot a kref_get, resulting in a premature drbd_destroy_device and use after free, and further to kernel crashes with symptoms. Relevance: No one should use DRBD as a random data generator, and apparently all users of \"two-primaries\" handle concurrent writes correctly on layer up. That is cluster file systems use some distributed lock manager, and live migration in virtualization environments stops writes on one node before starting writes on the other node. Which means that other than for \"test cases\", this code path is never taken in real life. FYI, in DRBD 9, things are handled differently nowadays. We still detect \"write conflicts\", but no longer try to be smart about them. We decided to disconnect hard instead: upper layers must not submit concurrent writes. If they do, that's their fault.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38711\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb/server: avoid deadlock when linking with ReplaceIfExists If smb2_create_link() is called with ReplaceIfExists set and the name does exist then a deadlock will happen. ksmbd_vfs_kern_path_locked() will return with success and the parent directory will be locked. ksmbd_vfs_remove_file() will then remove the file. ksmbd_vfs_link() will then be called while the parent is still locked. It will try to lock the same parent and will deadlock. This patch moves the ksmbd_vfs_kern_path_unlock() call to *before* ksmbd_vfs_link() and then simplifies the code, removing the file_present flag variable.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38712\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplus_fill_super() assumes that the attributes file is not yet created, which later results in hitting BUG_ON() when hfsplus_create_attributes_file() is called. Replace this BUG_ON() with -EIO error with a message to suggest running fsck tool.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38713\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc(): [ 667.121659][ T9805] ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][ T9805] [ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0 [ 667.124911][ T9805] print_report+0xd0/0x660 [ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610 [ 667.124928][ T9805] ? __phys_addr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124942][ T9805] kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][ T9805] hfsplus_uni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360 [ 667.124974][ T9805] hfsplus_readdir+0x845/0xfc0 [ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10 [ 667.124994][ T9805] ? stack_trace_save+0x8e/0xc0 [ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125015][ T9805] ? trace_lock_acquire+0x85/0xd0 [ 667.125022][ T9805] ? lock_acquire+0x30/0x80 [ 667.125029][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10 [ 667.125058][ T9805] ? apparmor_file_permission+0x239/0x3e0 [ 667.125069][ T9805] iterate_dir+0x296/0xb20 [ 667.125076][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10 [ 667.125091][ T9805] ? __x64_sys_openat+0x141/0x200 [ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10 [ 667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0 [ 667.125143][ T9805] do_syscall_64+0xc9/0x480 [ 667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] [ 667.125210][ T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasan_save_stack+0x20/0x40 [ 667.146352][ T9805] kasan_save_track+0x14/0x30 [ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0 [ 667.147065][ T9805] __kmalloc_noprof+0x205/0x550 [ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0 [ 667.147813][ T9805] hfsplus_readdir+0x220/0xfc0 [ 667.148174][ T9805] iterate_dir+0x296/0xb20 [ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805] do_syscall_64+0xc9/0x480 [ 667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.1 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38714\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() The hfsplus_bnode_read() method can trigger the issue: [ 174.852007][ T9784] ================================================================== [ 174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360 [ 174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784 [ 174.854059][ T9784] [ 174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full) [ 174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.854286][ T9784] Call Trace: [ 174.854289][ T9784] [ 174.854292][ T9784] dump_stack_lvl+0x10e/0x1f0 [ 174.854305][ T9784] print_report+0xd0/0x660 [ 174.854315][ T9784] ? __virt_addr_valid+0x81/0x610 [ 174.854323][ T9784] ? __phys_addr+0xe8/0x180 [ 174.854330][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854337][ T9784] kasan_report+0xc6/0x100 [ 174.854346][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854354][ T9784] hfsplus_bnode_read+0x2f4/0x360 [ 174.854362][ T9784] hfsplus_bnode_dump+0x2ec/0x380 [ 174.854370][ T9784] ? __pfx_hfsplus_bnode_dump+0x10/0x10 [ 174.854377][ T9784] ? hfsplus_bnode_write_u16+0x83/0xb0 [ 174.854385][ T9784] ? srcu_gp_start+0xd0/0x310 [ 174.854393][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854402][ T9784] hfsplus_brec_remove+0x3d2/0x4e0 [ 174.854411][ T9784] __hfsplus_delete_attr+0x290/0x3a0 [ 174.854419][ T9784] ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10 [ 174.854427][ T9784] ? __pfx___hfsplus_delete_attr+0x10/0x10 [ 174.854436][ T9784] ? __asan_memset+0x23/0x50 [ 174.854450][ T9784] hfsplus_delete_all_attrs+0x262/0x320 [ 174.854459][ T9784] ? __pfx_hfsplus_delete_all_attrs+0x10/0x10 [ 174.854469][ T9784] ? rcu_is_watching+0x12/0xc0 [ 174.854476][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854483][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.854493][ T9784] ? __pfx_hfsplus_delete_cat+0x10/0x10 [ 174.854507][ T9784] hfsplus_unlink+0x1ca/0x7c0 [ 174.854516][ T9784] ? __pfx_hfsplus_unlink+0x10/0x10 [ 174.854525][ T9784] ? down_write+0x148/0x200 [ 174.854532][ T9784] ? __pfx_down_write+0x10/0x10 [ 174.854540][ T9784] vfs_unlink+0x2fe/0x9b0 [ 174.854549][ T9784] do_unlinkat+0x490/0x670 [ 174.854557][ T9784] ? __pfx_do_unlinkat+0x10/0x10 [ 174.854565][ T9784] ? __might_fault+0xbc/0x130 [ 174.854576][ T9784] ? getname_flags.part.0+0x1c5/0x550 [ 174.854584][ T9784] __x64_sys_unlink+0xc5/0x110 [ 174.854592][ T9784] do_syscall_64+0xc9/0x480 [ 174.854600][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167 [ 174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08 [ 174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167 [ 174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50 [ 174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40 [ 174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0 [ 174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 174.854658][ T9784] [ 174.854661][ T9784] [ 174.879281][ T9784] Allocated by task 9784: [ 174.879664][ T9784] kasan_save_stack+0x20/0x40 [ 174.880082][ T9784] kasan_save_track+0x14/0x30 [ 174.880500][ T9784] __kasan_kmalloc+0xaa/0xb0 [ 174.880908][ T9784] __kmalloc_noprof+0x205/0x550 [ 174.881337][ T9784] __hfs_bnode_create+0x107/0x890 [ 174.881779][ T9784] hfsplus_bnode_find+0x2d0/0xd10 [ 174.882222][ T9784] hfsplus_brec_find+0x2b0/0x520 [ 174.882659][ T9784] hfsplus_delete_all_attrs+0x23b/0x3 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38715\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfs: fix slab-out-of-bounds in hfs_bnode_read() This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(), hfs_bnode_copy(), and hfs_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38721\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone. This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0. This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever. This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list. One fix would to change this to: if (res < 0) { if (ct != last) nf_conntrack_get(&ct->ct_general); But this reference counting isn't needed in the first place. We can just store a cookie value instead. A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-772 Missing Release of Resource after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38723\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix jump offset calculation in tailcall The extra pass of bpf_int_jit_compile() skips JIT context initialization which essentially skips offset calculation leaving out_offset = -1, so the jmp_offset in emit_bpf_tail_call is calculated by \"#define jmp_offset (out_offset - (cur_offset))\" is a negative number, which is wrong. The final generated assembly are as follow. 54: bgeu $a2, $t1, -8 # 0x0000004c 58: addi.d $a6, $s5, -1 5c: bltz $a6, -16 # 0x0000004c 60: alsl.d $t2, $a2, $a1, 0x3 64: ld.d $t2, $t2, 264 68: beq $t2, $zero, -28 # 0x0000004c Before apply this patch, the follow test case will reveal soft lock issues. cd tools/testing/selftests/bpf/ ./test_progs --allow=tailcalls/tailcall_bpf2bpf_1 dmesg: watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [test_progs:25056]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38724\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38725\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: add phy_mask for ax88772 mdio bus Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00 ~ 0x1f. DLink DUB-E100 H/W Ver B1 is such a device. However, only one main phy device will bind to net phy driver. This is creating issue during system suspend/resume since phy_polling_mode() in phy_state_machine() will directly deference member of phydev->drv for non-main phy devices. Then NULL pointer dereference issue will occur. Due to only external phy or internal phy is necessary, add phy_mask for ax88772 mdio bus to workarnoud the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38727\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has: rmem < READ_ONCE(sk->sk_rcvbuf) to check if the just increased rmem value fits into the socket's receive buffer. If not, it proceeds and tries to wait for the memory under: rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf) The checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is equal to sk->sk_rcvbuf. Thus the function neither successfully accepts these conditions, nor manages to reschedule the task - and is called in retry loop for indefinite time which is caught as: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 0-....: (25999 ticks this GP) idle=ef2/1/0x4000000000000000 softirq=262269/262269 fqs=6212 (t=26000 jiffies g=230833 q=259957) NMI backtrace for cpu 0 CPU: 0 PID: 22 Comm: kauditd Not tainted 5.10.240 #68 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc42 04/01/2014 Call Trace: dump_stack lib/dump_stack.c:120 nmi_cpu_backtrace.cold lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace lib/nmi_backtrace.c:62 rcu_dump_cpu_stacks kernel/rcu/tree_stall.h:335 rcu_sched_clock_irq.cold kernel/rcu/tree.c:2590 update_process_times kernel/time/timer.c:1953 tick_sched_handle kernel/time/tick-sched.c:227 tick_sched_timer kernel/time/tick-sched.c:1399 __hrtimer_run_queues kernel/time/hrtimer.c:1652 hrtimer_interrupt kernel/time/hrtimer.c:1717 __sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1113 asm_call_irq_on_stack arch/x86/entry/entry_64.S:808 netlink_attachskb net/netlink/af_netlink.c:1234 netlink_unicast net/netlink/af_netlink.c:1349 kauditd_send_queue kernel/audit.c:776 kauditd_thread kernel/audit.c:897 kthread kernel/kthread.c:328 ret_from_fork arch/x86/entry/entry_64.S:304 Restore the original behavior of the check which commit in Fixes accidentally missed when restructuring the code. Found by Linux Verification Center (linuxtesting.org).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38728\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below): BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827 CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38729\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38732\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't leak dst refcount for loopback packets recent patches to add a WARN() when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 [..] Call Trace: nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] .. This is because blamed commit forgot about loopback packets. Such packets already have a dst_entry attached, even at PRE_ROUTING stage. Instead of checking hook just check if the skb already has a route attached to it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-911 Improper Update of Reference Count\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.8\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38735\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: gve: prevent ethtool ops after shutdown A crash can occur if an ethtool operation is invoked after shutdown() is called. shutdown() is invoked during system shutdown to stop DMA operations without performing expensive deallocations. It is discouraged to unregister the netdev in this path, so the device may still be visible to userspace and kernel helpers. In gve, shutdown() tears down most internal data structures. If an ethtool operation is dispatched after shutdown(), it will dereference freed or NULL pointers, leading to a kernel panic. While graceful shutdown normally quiesces userspace before invoking the reboot syscall, forced shutdowns (as observed on GCP VMs) can still trigger this path. Fix by calling netif_device_detach() in shutdown(). This marks the device as detached so the ethtool ioctl handler will skip dispatching operations to the driver.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-664 Improper Control of a Resource Through its Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38736\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization Syzbot reported shift-out-of-bounds exception on MDIO bus initialization. The PHY address should be masked to 5 bits (0-31). Without this mask, invalid PHY addresses could be used, potentially causing issues with MDIO bus operations. Fix this by masking the PHY address with 0x1f (31 decimal) to ensure it stays within the valid range.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39673\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic. 2. pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels. Fix these by using a lockless RCU approach: - Use list_first_or_null_rcu() to safely test and access the first list entry. - Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal. - Check for a NULL pch->chan before dereferencing it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39675\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() The function mod_hdcp_hdcp1_create_session() calls the function get_first_active_display(), but does not check its return value. The return value is a null pointer if the display list is empty. This will lead to a null pointer dereference. Add a null pointer check for get_first_active_display() and return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND if the function return null. This is similar to the commit c3e9826a2202 (\"drm/amd/display: Add null pointer check for get_first_active_display()\"). (cherry picked from commit 5e43eb3cd731649c4f8b9134f857be62a416c893)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39676\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Prevent a potential error pointer dereference The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-394 Unexpected Status Code or Return Value\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.1\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39681\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd (\"x86/resctrl: Query LLC monitoring properties once during boot\") resctrl_cpu_detect() has been moved from common CPU initialization code to the vendor-specific BSP init helper, while Hygon didn't put that call in their code. This triggers a division by zero fault during early booting stage on our machines with X86_FEATURE_CQM* supported, where get_rdt_mon_resources() tries to calculate mon_l3_config with uninitialized boot_cpu_data.x86_cache_occ_scale. Add the missing resctrl_cpu_detect() in the Hygon BSP init helper. [ bp: Massage commit message. ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-369 Divide By Zero\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39682\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39683\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser->buffer when trace_get_user failed When the length of the string written to set_ftrace_filter exceeds FTRACE_BUFF_MAX, the following KASAN alarm will be triggered: BUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0 Read of size 1 at addr ffff0000d00bd5ba by task ash/165 CPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x34/0x50 (C) dump_stack_lvl+0xa0/0x158 print_address_description.constprop.0+0x88/0x398 print_report+0xb0/0x280 kasan_report+0xa4/0xf0 __asan_report_load1_noabort+0x20/0x30 strsep+0x18c/0x1b0 ftrace_process_regex.isra.0+0x100/0x2d8 ftrace_regex_release+0x484/0x618 __fput+0x364/0xa58 ____fput+0x28/0x40 task_work_run+0x154/0x278 do_notify_resume+0x1f0/0x220 el0_svc+0xec/0xf0 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1ac/0x1b0 The reason is that trace_get_user will fail when processing a string longer than FTRACE_BUFF_MAX, but not set the end of parser->buffer to 0. Then an OOB access will be triggered in ftrace_regex_release-> ftrace_process_regex->strsep->strpbrk. We can solve this problem by limiting access to parser->buffer when trace_get_user failed.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39684\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() syzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`. A kernel buffer is allocated to hold `insn->n` samples (each of which is an `unsigned int`). For some instruction types, `insn->n` samples are copied back to user-space, unless an error code is being returned. The problem is that not all the instruction handlers that need to return data to userspace fill in the whole `insn->n` samples, so that there is an information leak. There is a similar syzbot report for `do_insnlist_ioctl()`, although it does not have a reproducer for it at the time of writing. One culprit is `insn_rw_emulate_bits()` which is used as the handler for `INSN_READ` or `INSN_WRITE` instructions for subdevices that do not have a specific handler for that instruction, but do have an `INSN_BITS` handler. For `INSN_READ` it only fills in at most 1 sample, so if `insn->n` is greater than 1, the remaining `insn->n - 1` samples copied to userspace will be uninitialized kernel data. Another culprit is `vm80xx_ai_insn_read()` in the \"vm80xx\" driver. It never returns an error, even if it fails to fill the buffer. Fix it in `do_insn_ioctl()` and `do_insnlist_ioctl()` by making sure that uninitialized parts of the allocated buffer are zeroed before handling each instruction. Thanks to Arnaud Lecomte for their fix to `do_insn_ioctl()`. That fix replaced the call to `kmalloc_array()` with `kcalloc()`, but it is not always necessary to clear the whole buffer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39685\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: pcl726: Prevent invalid irq number The reproducer passed in an irq number(0x80008000) that was too large, which triggered the oob. Added an interrupt number check to prevent users from passing in an irq number that was too large. If `it->options[1]` is 31, then `1 << it->options[1]` is still invalid because it shifts a 1-bit into the sign bit (which is UB in C). Possible solutions include reducing the upper bound on the `it->options[1]` value to 30 or lower, or using `1U << it->options[1]`. The old code would just not attempt to request the IRQ if the `options[1]` value were invalid. And it would still configure the device without interrupts even if the call to `request_irq` returned an error. So it would be better to combine this test with the test below.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39686\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: Make insn_rw_emulate_bits() do insn->n samples The `insn_rw_emulate_bits()` function is used as a default handler for `INSN_READ` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_READ`. Similarly, it is used as a default handler for `INSN_WRITE` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_WRITE`. It works by emulating the `INSN_READ` or `INSN_WRITE` instruction handling with a constructed `INSN_BITS` instruction. However, `INSN_READ` and `INSN_WRITE` instructions are supposed to be able read or write multiple samples, indicated by the `insn->n` value, but `insn_rw_emulate_bits()` currently only handles a single sample. For `INSN_READ`, the comedi core will copy `insn->n` samples back to user-space. (That triggered KASAN kernel-infoleak errors when `insn->n` was greater than 1, but that is being fixed more generally elsewhere in the comedi core.) Make `insn_rw_emulate_bits()` either handle `insn->n` samples, or return an error, to conform to the general expectation for `INSN_READ` and `INSN_WRITE` handlers.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39687\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: light: as73211: Ensure buffer holes are zeroed Given that the buffer is copied to a kfifo that ultimately user space can read, ensure we zero it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39689\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the reader keeps the pointer to the filter hashes. This is problematic because this pointer is static across function calls that release the locks that can update the global tracer hashes. This can cause UAF and similar bugs. Allocate and copy the hash for reading the filter files like it is done for the writers. This not only fixes UAF bugs, but also makes the code a bit simpler as it doesn't have to differentiate when to free the iterator's hash between writers and readers.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39691\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.16.0-862.14.0.6.x86_64 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: dump_stack_lvl+0x55/0x70 print_address_description.constprop.0+0x2c/0x390 print_report+0xb4/0x270 kasan_report+0xb8/0xf0 end_buffer_read_sync+0xe3/0x110 end_bio_bh_io_sync+0x56/0x80 blk_update_request+0x30a/0x720 scsi_end_request+0x51/0x2b0 scsi_io_completion+0xe3/0x480 ? scsi_device_unbusy+0x11e/0x160 blk_complete_reqs+0x7b/0x90 handle_softirqs+0xef/0x370 irq_exit_rcu+0xa5/0xd0 sysvec_apic_timer_interrupt+0x6e/0x90 Above issue happens when do ntfs3 filesystem mount, issue may happens as follows: mount IRQ ntfs_fill_super read_cache_page do_read_cache_folio filemap_read_folio mpage_read_folio do_mpage_readpage ntfs_get_block_vbo bh_read submit_bh wait_on_buffer(bh); blk_complete_reqs scsi_io_completion scsi_end_request blk_update_request end_bio_bh_io_sync end_buffer_read_sync __end_buffer_read_notouch unlock_buffer wait_on_buffer(bh);--> return will return to caller put_bh --> trigger stack-out-of-bounds In the mpage_read_folio() function, the stack variable 'map_bh' is passed to ntfs_get_block_vbo(). Once unlock_buffer() unlocks and wait_on_buffer() returns to continue processing, the stack variable is likely to be reclaimed. Consequently, during the end_buffer_read_sync() process, calling put_bh() may result in stack overrun. If the bh is not allocated on the stack, it belongs to a folio. Freeing a buffer head which belongs to a folio is done by drop_buffers() which will fail to free buffers which are still locked. So it is safe to call put_bh() before __end_buffer_read_notouch().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39692\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() We can't call destroy_workqueue(smb_direct_wq); before stop_sessions()! Otherwise already existing connections try to use smb_direct_wq as a NULL pointer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39693\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid a NULL pointer dereference [WHY] Although unlikely drm_atomic_get_new_connector_state() or drm_atomic_get_old_connector_state() can return NULL. [HOW] Check returns before dereference. (cherry picked from commit 1e5e8d672fec9f2ab352be121be971877bff2af9)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39694\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrupt is NULL. This check is performed after physical to virtual address translation. If the kernel identity mapping does not start at address zero, the resulting virtual address is never zero, so that the NULL checks won't work. Subsequently this may result in incorrect accesses to the first page of the identity mapping. Fix this by introducing a function that handles the NULL case before address translation.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39697\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_request() from succeeding until we actually lock the page group. The reason is that whoever called nfs_inode_remove_request() doesn't necessarily have a lock on the page group head. So in order to avoid races, let's take the page group lock earlier in nfs_lock_and_join_requests(), and hold it across the removal of the request in nfs_inode_remove_request().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39701\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: Fix the driver update version check The security-version-number check should be used rather than the runtime version check for driver updates. Otherwise, the firmware update would fail when the update binary had a lower runtime version number than the current one. [ rjw: Changelog edits ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1025 Comparison Using Wrong Factors\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39702\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-208 Observable Timing Discrepancy\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39703\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net, hsr: reject HSR frame if skb can't hold tag Receiving HSR frame with insufficient space to hold HSR tag in the skb can result in a crash (kernel BUG): [ 45.390915] skbuff: skb_under_panic: text:ffffffff86f32cac len:26 put:14 head:ffff888042418000 data:ffff888042417ff4 tail:0xe end:0x180 dev:bridge_slave_1 [ 45.392559] ------------[ cut here ]------------ [ 45.392912] kernel BUG at net/core/skbuff.c:211! [ 45.393276] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 45.393809] CPU: 1 UID: 0 PID: 2496 Comm: reproducer Not tainted 6.15.0 #12 PREEMPT(undef) [ 45.394433] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 45.395273] RIP: 0010:skb_panic+0x15b/0x1d0 [ 45.402911] Call Trace: [ 45.403105] [ 45.404470] skb_push+0xcd/0xf0 [ 45.404726] br_dev_queue_push_xmit+0x7c/0x6c0 [ 45.406513] br_forward_finish+0x128/0x260 [ 45.408483] __br_forward+0x42d/0x590 [ 45.409464] maybe_deliver+0x2eb/0x420 [ 45.409763] br_flood+0x174/0x4a0 [ 45.410030] br_handle_frame_finish+0xc7c/0x1bc0 [ 45.411618] br_handle_frame+0xac3/0x1230 [ 45.413674] __netif_receive_skb_core.constprop.0+0x808/0x3df0 [ 45.422966] __netif_receive_skb_one_core+0xb4/0x1f0 [ 45.424478] __netif_receive_skb+0x22/0x170 [ 45.424806] process_backlog+0x242/0x6d0 [ 45.425116] __napi_poll+0xbb/0x630 [ 45.425394] net_rx_action+0x4d1/0xcc0 [ 45.427613] handle_softirqs+0x1a4/0x580 [ 45.427926] do_softirq+0x74/0x90 [ 45.428196] This issue was found by syzkaller. The panic happens in br_dev_queue_push_xmit() once it receives a corrupted skb with ETH header already pushed in linear data. When it attempts the skb_push() call, there's not enough headroom and skb_push() panics. The corrupted skb is put on the queue by HSR layer, which makes a sequence of unintended transformations when it receives a specific corrupted HSR frame (with incomplete TAG). Fix it by dropping and consuming frames that are not long enough to contain both ethernet and hsr headers. Alternative fix would be to check for enough headroom before skb_push() in br_dev_queue_push_xmit(). In the reproducer, this is injected via AF_PACKET, but I don't easily see why it couldn't be sent over the wire from adjacent network. Further Details: In the reproducer, the following network interface chain is set up: \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 veth0_to_hsr \u251c\u2500\u2500\u2500\u2524 hsr_slave0 \u253c\u2500\u2500\u2500\u2510 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u251c\u2500\u2524 hsr0 \u251c\u2500\u2500\u2500\u2510 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 \u2502\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 veth1_to_hsr \u253c\u2500\u2500\u2500\u2524 hsr_slave1 \u251c\u2500\u2500\u2500\u2518 \u2514\u2524 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u250c\u253c bridge \u2502 \u2502\u2502 \u2502 \u2502\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 \u2502 ... \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 To trigger the events leading up to crash, reproducer sends a corrupted HSR fr ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1286 Improper Validation of Syntactic Correctness of Input\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39706\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq Since KFD proc content was moved to kernel debugfs, we can't destroy KFD debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line debugfs_remove_recursive(entry->proc_dentry); tries to remove /sys/kernel/debug/kfd/proc/ while /sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel NULL pointer. (cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39709\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: protect against spurious interrupts during probe Make sure the interrupt handler is initialized before the interrupt is registered. If the IRQ is registered before hfi_create(), it's possible that an interrupt fires before the handler setup is complete, leading to a NULL dereference. This error condition has been observed during system boot on Rb3Gen2.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39710\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: Add a check for packet size after reading from shared memory Add a check to ensure that the packet size does not exceed the number of available words after reading the packet header from shared memory. This ensures that the size provided by the firmware is safe to process and prevent potential out-of-bounds memory access.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39713\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() In the interrupt handler rain_interrupt(), the buffer full check on rain->buf_len is performed before acquiring rain->buf_lock. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as rain->buf_len is concurrently accessed and modified in the work handler rain_irq_work_handler() under the same lock. Multiple interrupt invocations can race, with each reading buf_len before it becomes full and then proceeding. This can lead to both interrupts attempting to write to the buffer, incrementing buf_len beyond its capacity (DATA_SIZE) and causing a buffer overflow. Fix this bug by moving the spin_lock() to before the buffer full check. This ensures that the check and the subsequent buffer modification are performed atomically, preventing the race condition. An corresponding spin_unlock() is added to the overflow path to correctly release the lock. This possible bug was found by an experimental static analysis tool developed by our team.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39714\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: usbtv: Lock resolution while streaming When an program is streaming (ffplay) and another program (qv4l2) changes the TV standard from NTSC to PAL, the kernel crashes due to trying to copy to unmapped memory. Changing from NTSC to PAL increases the resolution in the usbtv struct, but the video plane buffer isn't adjusted, so it overflows. [hverkuil: call vb2_is_busy instead of vb2_is_streaming]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39715\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: parisc: Revise gateway LWS calls to probe user read access We use load and stbys,e instructions to trigger memory reference interruptions without writing to memory. Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel and gateway page execute at privilege level 0, so this code never triggers a read access interruption. Thus, it is currently possible for user code to execute a LWS compare and swap operation at an address that is read protected at privilege level 3 (PRIV_USER). Fix this by probing read access rights at privilege level 3 and branching to lws_fault if access isn't allowed.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39716\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: parisc: Revise __get_user() to probe user read access Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel executes at privilege level 0, so __get_user() never triggers a read access interruption (code 26). Thus, it is currently possible for user code to access a read protected address via a system call. Fix this by probing read access rights at privilege level 3 (PRIV_USER) and setting __gu_err to -EFAULT (-14) if access isn't allowed. Note the cmpiclr instruction does a 32-bit compare because COND macro doesn't work inside asm.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39718\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately, virtio_vsock_skb_rx_put() uses the length from the packet header as the length argument to skb_put(), potentially resulting in SKB overflow if the host has gone wonky. Validate the length as advertised by the packet header before calling virtio_vsock_skb_rx_put().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.6\nHIGH\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39719\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: imu: bno055: fix OOB access of hw_xlate array Fix a potential out-of-bounds array access of the hw_xlate array in bno055.c. In bno055_get_regmask(), hw_xlate was iterated over the length of the vals array instead of the length of the hw_xlate array. In the case of bno055_gyr_scale, the vals array is larger than the hw_xlate array, so this could result in an out-of-bounds access. In practice, this shouldn't happen though because a match should always be found which breaks out of the for loop before it iterates beyond the end of the hw_xlate array. By adding a new hw_xlate_len field to the bno055_sysfs_attr, we can be sure we are iterating over the correct length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39724\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix panic due to PSLVERR When the PSLVERR_RESP_EN parameter is set to 1, the device generates an error response if an attempt is made to read an empty RBR (Receive Buffer Register) while the FIFO is enabled. In serial8250_do_startup(), calling serial_port_out(port, UART_LCR, UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes dw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter function enables the FIFO via serial_out(p, UART_FCR, p->fcr). Execution proceeds to the serial_port_in(port, UART_RX). This satisfies the PSLVERR trigger condition. When another CPU (e.g., using printk()) is accessing the UART (UART is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter dw8250_force_idle(). Put serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock to fix this issue. Panic backtrace: [ 0.442336] Oops - unknown exception [#1] [ 0.442343] epc : dw8250_serial_in32+0x1e/0x4a [ 0.442351] ra : serial8250_do_startup+0x2c8/0x88e ... [ 0.442416] console_on_rootfs+0x26/0x70\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39736\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() can cause a deadlock due to lock inversion with the netconsole subsystem. This occurs because pr_warn_once() may trigger netpoll, which eventually leads to __alloc_skb() and back into kmemleak code, attempting to reacquire kmemleak_lock. This is the path for the deadlock. mem_pool_alloc() -> raw_spin_lock_irqsave(&kmemleak_lock, flags); -> pr_warn_once() -> netconsole subsystem -> netpoll -> __alloc_skb -> __create_object -> raw_spin_lock_irqsave(&kmemleak_lock, flags); Fix this by setting a flag and issuing the pr_warn_once() after kmemleak_lock is released.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-833 Deadlock\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39737\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() A soft lockup warning was observed on a relative small system x86-64 system with 16 GB of memory when running a debug kernel with kmemleak enabled. watchdog: BUG: soft lockup - CPU#8 stuck for 33s! [kworker/8:1:134] The test system was running a workload with hot unplug happening in parallel. Then kemleak decided to disable itself due to its inability to allocate more kmemleak objects. The debug kernel has its CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE set to 40,000. The soft lockup happened in kmemleak_do_cleanup() when the existing kmemleak objects were being removed and deleted one-by-one in a loop via a workqueue. In this particular case, there are at least 40,000 objects that need to be processed and given the slowness of a debug kernel and the fact that a raw_spinlock has to be acquired and released in __delete_object(), it could take a while to properly handle all these objects. As kmemleak has been disabled in this case, the object removal and deletion process can be further optimized as locking isn't really needed. However, it is probably not worth the effort to optimize for such an edge case that should rarely happen. So the simple solution is to call cond_resched() at periodic interval in the iteration loop to avoid soft lockup.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39738\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: do not allow relocation of partially dropped subvolumes [BUG] There is an internal report that balance triggered transaction abort, with the following call trace: item 85 key (594509824 169 0) itemoff 12599 itemsize 33 extent refs 1 gen 197740 flags 2 ref#0: tree block backref root 7 item 86 key (594558976 169 0) itemoff 12566 itemsize 33 extent refs 1 gen 197522 flags 2 ref#0: tree block backref root 7 ... BTRFS error (device loop0): extent item not found for insert, bytenr 594526208 num_bytes 16384 parent 449921024 root_objectid 934 owner 1 offset 0 BTRFS error (device loop0): failed to run delayed ref for logical 594526208 num_bytes 16384 type 182 action 1 ref_mod 1: -117 ------------[ cut here ]------------ BTRFS: Transaction aborted (error -117) WARNING: CPU: 1 PID: 6963 at ../fs/btrfs/extent-tree.c:2168 btrfs_run_delayed_refs+0xfa/0x110 [btrfs] And btrfs check doesn't report anything wrong related to the extent tree. [CAUSE] The cause is a little complex, firstly the extent tree indeed doesn't have the backref for 594526208. The extent tree only have the following two backrefs around that bytenr on-disk: item 65 key (594509824 METADATA_ITEM 0) itemoff 13880 itemsize 33 refs 1 gen 197740 flags TREE_BLOCK tree block skinny level 0 (176 0x7) tree block backref root CSUM_TREE item 66 key (594558976 METADATA_ITEM 0) itemoff 13847 itemsize 33 refs 1 gen 197522 flags TREE_BLOCK tree block skinny level 0 (176 0x7) tree block backref root CSUM_TREE But the such missing backref item is not an corruption on disk, as the offending delayed ref belongs to subvolume 934, and that subvolume is being dropped: item 0 key (934 ROOT_ITEM 198229) itemoff 15844 itemsize 439 generation 198229 root_dirid 256 bytenr 10741039104 byte_limit 0 bytes_used 345571328 last_snapshot 198229 flags 0x1000000000001(RDONLY) refs 0 drop_progress key (206324 EXTENT_DATA 2711650304) drop_level 2 level 2 generation_v2 198229 And that offending tree block 594526208 is inside the dropped range of that subvolume. That explains why there is no backref item for that bytenr and why btrfs check is not reporting anything wrong. But this also shows another problem, as btrfs will do all the orphan subvolume cleanup at a read-write mount. So half-dropped subvolume should not exist after an RW mount, and balance itself is also exclusive to subvolume cleanup, meaning we shouldn't hit a subvolume half-dropped during relocation. The root cause is, there is no orphan item for this subvolume. In fact there are 5 subvolumes from around 2021 that have the same problem. It looks like the original report has some older kernels running, and caused those zombie subvolumes. Thankfully upstream commit 8d488a8c7ba2 (\"btrfs: fix subvolume/snapshot deletion not triggered on mount\") has long fixed the bug. [ENHANCEMENT] For repairing such old fs, btrfs-progs will be enhanced. Considering how delayed the problem will show up (at run delayed ref time) and at that time we have to abort transaction already, it is too late. Instead here we reject any half-dropped subvolume for reloc tree at the earliest time, preventing confusion and extra time wasted on debugging similar bugs.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39742\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() The function divides number of online CPUs by num_core_siblings, and later checks the divider by zero. This implies a possibility to get and divide-by-zero runtime error. Fix it by moving the check prior to division. This also helps to save one indentation level.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-369 Divide By Zero\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39743\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: truncate good inode pages when hard link is 0 The fileset value of the inode copy from the disk by the reproducer is AGGR_RESERVED_I. When executing evict, its hard link number is 0, so its inode pages are not truncated. This causes the bugon to be triggered when executing clear_inode() because nrpages is greater than 0.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39749\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: rcu: Protect ->defer_qs_iw_pending from data race On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke rcu_read_unlock_special(), which uses an irq-work handler to force the system to notice when the RCU read-side critical section actually ends. That end won't happen until interrupts are enabled at the soonest. In some kernels, such as those booted with rcutree.use_softirq=y, the irq-work handler is used unconditionally. The per-CPU rcu_data structure's ->defer_qs_iw_pending field is updated by the irq-work handler and is both read and updated by rcu_read_unlock_special(). This resulted in the following KCSAN splat: ------------------------------------------------------------------------ BUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special read to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8: rcu_read_unlock_special+0x175/0x260 __rcu_read_unlock+0x92/0xa0 rt_spin_unlock+0x9b/0xc0 __local_bh_enable+0x10d/0x170 __local_bh_enable_ip+0xfb/0x150 rcu_do_batch+0x595/0xc40 rcu_cpu_kthread+0x4e9/0x830 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 write to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8: rcu_preempt_deferred_qs_handler+0x1e/0x30 irq_work_single+0xaf/0x160 run_irq_workd+0x91/0xc0 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 no locks held by irq_work/8/88. irq event stamp: 200272 hardirqs last enabled at (200272): [] finish_task_switch+0x131/0x320 hardirqs last disabled at (200271): [] __schedule+0x129/0xd70 softirqs last enabled at (0): [] copy_process+0x4df/0x1cc0 softirqs last disabled at (0): [<0000000000000000>] 0x0 ------------------------------------------------------------------------ The problem is that irq-work handlers run with interrupts enabled, which means that rcu_preempt_deferred_qs_handler() could be interrupted, and that interrupt handler might contain an RCU read-side critical section, which might invoke rcu_read_unlock_special(). In the strict KCSAN mode of operation used by RCU, this constitutes a data race on the ->defer_qs_iw_pending field. This commit therefore disables interrupts across the portion of the rcu_preempt_deferred_qs_handler() that updates the ->defer_qs_iw_pending field. This suffices because this handler is not a fast path.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39752\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ARM: rockchip: fix kernel hang during smp initialization In order to bring up secondary CPUs main CPU write trampoline code to SRAM. The trampoline code is written while secondary CPUs are powered on (at least that true for RK3188 CPU). Sometimes that leads to kernel hang. Probably because secondary CPU execute trampoline code while kernel doesn't expect. The patch moves SRAM initialization step to the point where all secondary CPUs are powered down. That fixes rarely hangs on RK3188: [ 0.091568] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.091996] rockchip_smp_prepare_cpus: ncores 4\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-364 Signal Handler Race Condition\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39756\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c: WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288 This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN. Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate: - File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes - Multiple bitmaps: ~400MB - Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647) Reproducer: 1. Set /proc/sys/fs/nr_open to 1073741816: # echo 1073741816 > /proc/sys/fs/nr_open 2. Run a program that uses a high file descriptor: #include #include int main() { struct rlimit rlim = {1073741824, 1073741824}; setrlimit(RLIMIT_NOFILE, &rlim); dup2(2, 1073741880); // Triggers the warning return 0; } 3. Observe WARNING in dmesg at mm/slub.c:5027 systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that: 1. The kernel's allocation functions still enforce INT_MAX as a maximum size regardless of memcg accounting 2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations 3. The resulting allocations (>8GB) are impractical and will always fail systemd's algorithm starts with INT_MAX and keeps halving the value until the kernel accepts it. On most systems, this results in nr_open being set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors. While processes rarely use file descriptors near this limit in normal operation, certain selftests (like tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue. Fix this by adding a check in alloc_fdtable() to ensure the requested allocation size does not exceed INT_MAX. This causes the operation to fail with -EMFILE instead of triggering a kernel warning and avoids the impractical >8GB memory allocation request.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39757\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39759\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix race between quota disable and quota rescan ioctl There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fs_info->qgroup_tree rbtree. This happens as follows: 1) Task A enters btrfs_ioctl_quota_rescan() -> btrfs_qgroup_rescan(); 2) Task B enters btrfs_quota_disable() and calls btrfs_qgroup_wait_for_completion(), which does nothing because at that point fs_info->qgroup_rescan_running is false (it wasn't set yet by task A); 3) Task B calls btrfs_free_qgroup_config() which starts freeing qgroups from fs_info->qgroup_tree without taking the lock fs_info->qgroup_lock; 4) Task A enters qgroup_rescan_zero_tracking() which starts iterating the fs_info->qgroup_tree tree while holding fs_info->qgroup_lock, but task B is freeing qgroup records from that tree without holding the lock, resulting in a use-after-free. Fix this by taking fs_info->qgroup_lock at btrfs_free_qgroup_config(). Also at btrfs_qgroup_rescan() don't start the rescan worker if quotas were already disabled.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39760\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this up by checking the size first before looking at any of the fields in the descriptor.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39766\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \\ htb rate 64bit tc qdisc add dev lo parent 1:1 handle f: \\ cake memlimit 1b ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 This is because the low memlimit leads to a low buffer_limit, which causes packet dropping. However, cake_enqueue still returns NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an empty child qdisc. We should return NET_XMIT_CN when packets are dropped from the same tin and flow. I do not believe return value of NET_XMIT_CN is necessary for packet drops in the case of ack filtering, as that is meant to optimize performance, not to signal congestion.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39770\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM When performing Generic Segmentation Offload (GSO) on an IPv6 packet that contains extension headers, the kernel incorrectly requests checksum offload if the egress device only advertises NETIF_F_IPV6_CSUM feature, which has a strict contract: it supports checksum offload only for plain TCP or UDP over IPv6 and explicitly does not support packets with extension headers. The current GSO logic violates this contract by failing to disable the feature for packets with extension headers, such as those used in GREoIPv6 tunnels. This violation results in the device being asked to perform an operation it cannot support, leading to a `skb_warn_bad_offload` warning and a collapse of network throughput. While device TSO/USO is correctly bypassed in favor of software GSO for these packets, the GSO stack must be explicitly told not to request checksum offload. Mask NETIF_F_IPV6_CSUM, NETIF_F_TSO6 and NETIF_F_GSO_UDP_L4 in gso_features_check if the IPv6 header contains extension headers to compute checksum in software. The exception is a BIG TCP extension, which, as stated in commit 68e068cabd2c6c53 (\"net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets\"): \"The feature is only enabled on devices that support BIG TCP TSO. The header is only present for PF_PACKET taps like tcpdump, and not transmitted by physical devices.\" kernel log output (truncated): WARNING: CPU: 1 PID: 5273 at net/core/dev.c:3535 skb_warn_bad_offload+0x81/0x140 ... Call Trace: skb_checksum_help+0x12a/0x1f0 validate_xmit_skb+0x1a3/0x2d0 validate_xmit_skb_list+0x4f/0x80 sch_direct_xmit+0x1a2/0x380 __dev_xmit_skb+0x242/0x670 __dev_queue_xmit+0x3fc/0x7f0 ip6_finish_output2+0x25e/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_tnl_xmit+0x608/0xc00 [ip6_tunnel] ip6gre_tunnel_xmit+0x1c0/0x390 [ip6_gre] dev_hard_start_xmit+0x63/0x1c0 __dev_queue_xmit+0x6d0/0x7f0 ip6_finish_output2+0x214/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 inet6_csk_xmit+0xeb/0x150 __tcp_transmit_skb+0x555/0xa80 tcp_write_xmit+0x32a/0xe90 tcp_sendmsg_locked+0x437/0x1110 tcp_sendmsg+0x2f/0x50 ... skb linear: 00000000: e4 3d 1a 7d ec 30 e4 3d 1a 7e 5d 90 86 dd 60 0e skb linear: 00000010: 00 0a 1b 34 3c 40 20 11 00 00 00 00 00 00 00 00 skb linear: 00000020: 00 00 00 00 00 12 20 11 00 00 00 00 00 00 00 00 skb linear: 00000030: 00 00 00 00 00 11 2f 00 04 01 04 01 01 00 00 00 skb linear: 00000040: 86 dd 60 0e 00 0a 1b 00 06 40 20 23 00 00 00 00 skb linear: 00000050: 00 00 00 00 00 00 00 00 00 12 20 23 00 00 00 00 skb linear: 00000060: 00 00 00 00 00 00 00 00 00 11 bf 96 14 51 13 f9 skb linear: 00000070: ae 27 a0 a8 2b e3 80 18 00 40 5b 6f 00 00 01 01 skb linear: 00000080: 08 0a 42 d4 50 d5 4b 70 f8 1a\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-573 Improper Following of Specification by Caller\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39772\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/hisilicon/hibmc: fix the hibmc loaded failed bug When hibmc loaded failed, the driver use hibmc_unload to free the resource, but the mutexes in mode.config are not init, which will access an NULL pointer. Just change goto statement to return, because hibnc_hw_init() doesn't need to free anything.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39773\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() When set multicast_query_interval to a large value, the local variable 'time' in br_multicast_send_query() may overflow. If the time is smaller than jiffies, the timer will expire immediately, and then call mod_timer() again, which creates a loop and may trigger the following soft lockup issue. watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rb_consumer:66] CPU: 1 UID: 0 PID: 66 Comm: rb_consumer Not tainted 6.16.0+ #259 PREEMPT(none) Call Trace: __netdev_alloc_skb+0x2e/0x3a0 br_ip6_multicast_alloc_query+0x212/0x1b70 __br_multicast_send_query+0x376/0xac0 br_multicast_send_query+0x299/0x510 br_multicast_query_expired.constprop.0+0x16d/0x1b0 call_timer_fn+0x3b/0x2a0 __run_timers+0x619/0x950 run_timer_softirq+0x11c/0x220 handle_softirqs+0x18e/0x560 __irq_exit_rcu+0x158/0x1a0 sysvec_apic_timer_interrupt+0x76/0x90 This issue can be reproduced with: ip link add br0 type bridge echo 1 > /sys/class/net/br0/bridge/multicast_querier echo 0xffffffffffffffff > /sys/class/net/br0/bridge/multicast_query_interval ip link set dev br0 up The multicast_startup_query_interval can also cause this issue. Similar to the commit 99b40610956a (\"net: bridge: mcast: add and enforce query interval minimum\"), add check for the query interval maximum to fix this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39776\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: clear page table entries at destroy_args() The mm/debug_vm_pagetable test allocates manually page table entries for the tests it runs, using also its manually allocated mm_struct. That in itself is ok, but when it exits, at destroy_args() it fails to clear those entries with the *_clear functions. The problem is that leaves stale entries. If another process allocates an mm_struct with a pgd at the same address, it may end up running into the stale entry. This is happening in practice on a debug kernel with CONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra debugging I added (it prints a warning trace if pgtables_bytes goes negative, in addition to the warning at check_mm() function): [ 2.539353] debug_vm_pgtable: [get_random_vaddr ]: random_vaddr is 0x7ea247140000 [ 2.539366] kmem_cache info [ 2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508 [ 2.539447] debug_vm_pgtable: [init_args ]: args->mm is 0x000000002267cc9e (...) [ 2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0 [ 2.552816] Modules linked in: [ 2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY [ 2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries [ 2.552872] NIP: c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90 [ 2.552885] REGS: c0000000622e73b0 TRAP: 0700 Not tainted (6.12.0-105.debug_vm2.el10.ppc64le+debug) [ 2.552899] MSR: 800000000282b033 CR: 24002822 XER: 0000000a [ 2.552954] CFAR: c0000000008f03f0 IRQMASK: 0 [ 2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001 [ 2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff [ 2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000 [ 2.552954] GPR12: 00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb [ 2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0 [ 2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000 [ 2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001 [ 2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760 [ 2.553170] NIP [c0000000007eef3c] free_pud_range+0x8bc/0x8d0 [ 2.553185] LR [c0000000007eef30] free_pud_range+0x8b0/0x8d0 [ 2.553199] Call Trace: [ 2.553207] [c0000000622e7650] [c0000000007eef30] free_pud_range+0x8b0/0x8d0 (unreliable) [ 2.553229] [c0000000622e7750] [c0000000007f40b4] free_pgd_range+0x284/0x3b0 [ 2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables+0x450/0x570 [ 2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap+0x250/0x650 [ 2.553292] [c0000000622e7a30] [c0000000001b95b8] __mmput+0x98/0x290 [ 2.558344] [c0000000622e7a80] [c0000000001d1018] exit_mm+0x118/0x1b0 [ 2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit+0x2ec/0x870 [ 2.558376] [c0000000622e7b60] [c0000000001d1ca8] do_group_exit+0x88/0x150 [ 2.558391] [c0000000622e7bb0] [c0000000001d1db8] sys_exit_group+0x48/0x50 [ 2.558407] [c0000000622e7be0] [c00000000003d810] system_call_exception+0x1e0/0x4c0 [ 2.558423] [c0000000622e7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec (...) [ 2.558892] ---[ end trace 0000000000000000 ]--- [ 2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1 [ 2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144 Here the modprobe process ended up with an allocated mm_struct from the mm_struct slab that was used before by the debug_vm_pgtable test. That is not a problem, since the mm_stru ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39782\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2_log_do_checkpoint() Both jbd2_log_do_checkpoint() and jbd2_journal_shrink_checkpoint_list() periodically release j_list_lock after processing a batch of buffers to avoid long hold times on the j_list_lock. However, since both functions contend for j_list_lock, the combined time spent waiting and processing can be significant. jbd2_journal_shrink_checkpoint_list() explicitly calls cond_resched() when need_resched() is true to avoid softlockups during prolonged operations. But jbd2_log_do_checkpoint() only exits its loop when need_resched() is true, relying on potentially sleeping functions like __flush_batch() or wait_on_buffer() to trigger rescheduling. If those functions do not sleep, the kernel may hit a softlockup. watchdog: BUG: soft lockup - CPU#3 stuck for 156s! [kworker/u129:2:373] CPU: 3 PID: 373 Comm: kworker/u129:2 Kdump: loaded Not tainted 6.6.0+ #10 Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.27 06/13/2017 Workqueue: writeback wb_workfn (flush-7:2) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : native_queued_spin_lock_slowpath+0x358/0x418 lr : jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] Call trace: native_queued_spin_lock_slowpath+0x358/0x418 jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] __jbd2_log_wait_for_space+0xfc/0x2f8 [jbd2] add_transaction_credits+0x3bc/0x418 [jbd2] start_this_handle+0xf8/0x560 [jbd2] jbd2__journal_start+0x118/0x228 [jbd2] __ext4_journal_start_sb+0x110/0x188 [ext4] ext4_do_writepages+0x3dc/0x740 [ext4] ext4_writepages+0xa4/0x190 [ext4] do_writepages+0x94/0x228 __writeback_single_inode+0x48/0x318 writeback_sb_inodes+0x204/0x590 __writeback_inodes_wb+0x54/0xf8 wb_writeback+0x2cc/0x3d8 wb_do_writeback+0x2e0/0x2f8 wb_workfn+0x80/0x2a8 process_one_work+0x178/0x3e8 worker_thread+0x234/0x3b8 kthread+0xf0/0x108 ret_from_fork+0x10/0x20 So explicitly call cond_resched() in jbd2_log_do_checkpoint() to avoid softlockup.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39783\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, not a list entry. This list_del() call triggers a KASAN warning when an endpoint function driver which has a configfs attribute group is torn down: ================================================================== BUG: KASAN: slab-use-after-free in pci_epf_remove_cfs+0x17c/0x198 Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319 CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE Hardware name: Radxa ROCK 5B (DT) Call trace: show_stack+0x2c/0x84 (C) dump_stack_lvl+0x70/0x98 print_report+0x17c/0x538 kasan_report+0xb8/0x190 __asan_report_store8_noabort+0x20/0x2c pci_epf_remove_cfs+0x17c/0x198 pci_epf_unregister_driver+0x18/0x30 nvmet_pci_epf_cleanup_module+0x24/0x30 [nvmet_pci_epf] __arm64_sys_delete_module+0x264/0x424 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xac/0x230 do_el0_svc+0x40/0x58 el0_svc+0x48/0xdc el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c ... Remove this incorrect list_del() call from pci_epf_remove_cfs().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39787\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdt_loader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39788\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the driver ends up programming the UTRL_NEXUS_TYPE incorrectly as 0. This is because the left hand side of the shift is 1, which is of type int, i.e. 31 bits wide. Shifting by more than that width results in undefined behaviour. Fix this by switching to the BIT() macro, which applies correct type casting as required. This ensures the correct value is written to UTRL_NEXUS_TYPE (0xffffffff on gs101), and it also fixes a UBSAN shift warning: UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21 shift exponent 32 is too large for 32-bit type 'int' For consistency, apply the same change to the nutmrs / UTMRL_NEXUS_TYPE write.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39790\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a read pointer that is multiple elements ahead of the host's read pointer. For instance, if the host accesses an event ring while the device is updating it, the pointer inside of the event might still point to an old TRE. If the host uses the channel's xfer_cb() to directly free the buffer pointed to by the TRE, the buffer will be double-freed. This behavior was observed on an ep that used upstream EP stack without 'commit 6f18d174b73d (\"bus: mhi: ep: Update read pointer only after buffer is written\")'. Where the device updated the events ring pointer before updating the event contents, so it left a window where the host was able to access the stale data the event pointed to, before the device had the chance to update them. The usual pattern was that the host received an event pointing to a TRE that is not immediately after the last processed one, so it got treated as if it was a chained transaction, processing all of the TREs in between the two read pointers. This commit aims to harden the host by ensuring transactions where the event points to a TRE that isn't local_rp + 1 are chained. [mani: added stable tag and reworded commit message]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-415 Double Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.7\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39794\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ARM: tegra: Use I/O memcpy to write to IRAM Kasan crashes the kernel trying to check boundaries when using the normal memcpy.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39795\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: block: avoid possible overflow for chunk_sectors check in blk_stack_limits() In blk_stack_limits(), we check that the t->chunk_sectors value is a multiple of the t->physical_block_size value. However, by finding the chunk_sectors value in bytes, we may overflow the unsigned int which holds chunk_sectors, so change the check to be based on sectors.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-674 Uncontrolled Recursion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39798\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: NFS: Fix the setting of capabilities when automounting a new filesystem Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, and then probed for again.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-273 Improper Check for Dropped Privileges\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39800\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() If we find an unexpected generation for the extent buffer we are cloning at btrfs_copy_root(), we just WARN_ON() and don't error out and abort the transaction, meaning we allow to persist metadata with an unexpected generation. Instead of warning only, abort the transaction and return -EUCLEAN.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39801\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARN_ON for device endpoint command timeouts This commit addresses a rarely observed endpoint command timeout which causes kernel panic due to warn when 'panic_on_warn' is enabled and unnecessary call trace prints when 'panic_on_warn' is disabled. It is seen during fast software-controlled connect/disconnect testcases. The following is one such endpoint command timeout that we observed: 1. Connect ======= ->dwc3_thread_interrupt ->dwc3_ep0_interrupt ->configfs_composite_setup ->composite_setup ->usb_ep_queue ->dwc3_gadget_ep0_queue ->__dwc3_gadget_ep0_queue ->__dwc3_ep0_do_control_data ->dwc3_send_gadget_ep_cmd 2. Disconnect ========== ->dwc3_thread_interrupt ->dwc3_gadget_disconnect_interrupt ->dwc3_ep0_reset_state ->dwc3_ep0_end_control_data ->dwc3_send_gadget_ep_cmd In the issue scenario, in Exynos platforms, we observed that control transfers for the previous connect have not yet been completed and end transfer command sent as a part of the disconnect sequence and processing of USB_ENDPOINT_HALT feature request from the host timeout. This maybe an expected scenario since the controller is processing EP commands sent as a part of the previous connect. It maybe better to remove WARN_ON in all places where device endpoint commands are sent to avoid unnecessary kernel panic due to warn.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39806\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes. mt_report_fixup() attempts to patch byte offset 607 of the descriptor with 0x25 by first checking if byte offset 607 is 0x15 however it lacks bounds checks to verify if the descriptor is big enough before conducting this check. Fix this bug by ensuring the descriptor size is at least 608 bytes before accessing it. Below is the KASAN splat after the out of bounds access happens: [ 13.671954] ================================================================== [ 13.672667] BUG: KASAN: slab-out-of-bounds in mt_report_fixup+0x103/0x110 [ 13.673297] Read of size 1 at addr ffff888103df39df by task kworker/0:1/10 [ 13.673297] [ 13.673297] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-00005-gec5d573d83f4-dirty #3 [ 13.673297] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/04 [ 13.673297] Call Trace: [ 13.673297] [ 13.673297] dump_stack_lvl+0x5f/0x80 [ 13.673297] print_report+0xd1/0x660 [ 13.673297] kasan_report+0xe5/0x120 [ 13.673297] __asan_report_load1_noabort+0x18/0x20 [ 13.673297] mt_report_fixup+0x103/0x110 [ 13.673297] hid_open_report+0x1ef/0x810 [ 13.673297] mt_probe+0x422/0x960 [ 13.673297] hid_device_probe+0x2e2/0x6f0 [ 13.673297] really_probe+0x1c6/0x6b0 [ 13.673297] __driver_probe_device+0x24f/0x310 [ 13.673297] driver_probe_device+0x4e/0x220 [ 13.673297] __device_attach_driver+0x169/0x320 [ 13.673297] bus_for_each_drv+0x11d/0x1b0 [ 13.673297] __device_attach+0x1b8/0x3e0 [ 13.673297] device_initial_probe+0x12/0x20 [ 13.673297] bus_probe_device+0x13d/0x180 [ 13.673297] device_add+0xe3a/0x1670 [ 13.673297] hid_add_device+0x31d/0xa40 [...]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39808\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger page fault error for address(0xffffffffffffff58) add null check logic to ntrig_report_version() before calling hid_to_usb_dev()\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39812\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior. Clear sin6_scope_id and sin6_flowinfo. BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390 sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452 sctp_get_port net/sctp/socket.c:8523 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable addr.i.i created at: sctp_get_port net/sctp/socket.c:8515 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39813\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition. The issue occurs because: CPU0 (ftrace_dump) CPU1 (reader) echo z > /proc/sysrq-trigger !trace_empty(&iter) trace_iterator_reset(&iter) <- len = size = 0 cat /sys/kernel/tracing/trace_pipe trace_find_next_entry_inc(&iter) __find_next_entry ring_buffer_empty_cpu <- all empty return NULL trace_printk_seq(&iter.seq) WARN_ON_ONCE(s->seq.len >= s->seq.size) In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers. This caused trace_find_next_entry_inc to return NULL, failing to populate `iter.seq`. At this point, due to the prior trace_iterator_reset, both `iter.seq.len` and `iter.seq.size` were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered. Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39817\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe8/0x190 __asan_loadN+0x1c/0x28 memcmp+0x98/0xd0 efivarfs_d_compare+0x68/0xd8 __d_lookup_rcu_op_compare+0x178/0x218 __d_lookup_rcu+0x1f8/0x228 d_alloc_parallel+0x150/0x648 lookup_open.isra.0+0x5f0/0x8d0 open_last_lookups+0x264/0x828 path_openat+0x130/0x3f8 do_filp_open+0x114/0x248 do_sys_openat2+0x340/0x3c0 __arm64_sys_openat+0x120/0x1a0 If dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become negative, leadings to oob. The issue can be triggered by parallel lookups using invalid filename: T1 T2 lookup_open ->lookup simple_lookup d_add // invalid dentry is added to hash list lookup_open d_alloc_parallel __d_lookup_rcu __d_lookup_rcu_op_compare hlist_bl_for_each_entry_rcu // invalid dentry can be retrieved ->d_compare efivarfs_d_compare // oob Fix it by checking 'guid' before cmp.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39819\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/smb: Fix inconsistent refcnt update A possible inconsistent update of refcount was identified in `smb2_compound_op`. Such inconsistent update could lead to possible resource leaks. Why it is a possible bug: 1. In the comment section of the function, it clearly states that the reference to `cfile` should be dropped after calling this function. 2. Every control flow path would check and drop the reference to `cfile`, except the patched one. 3. Existing callers would not handle refcount update of `cfile` if -ENOMEM is returned. To fix the bug, an extra goto label \"out\" is added, to make sure that the cleanup logic would always be respected. As the problem is caused by the allocation failure of `vars`, the cleanup logic between label \"finished\" and \"out\" can be safely ignored. According to the definition of function `is_replayable_error`, the error code of \"-ENOMEM\" is not recoverable. Therefore, the replay logic also gets ignored.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39823\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39824\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device. This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees. 0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection Below is the KASAN splat after triggering the UAF: [ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700] __kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700] __kasan_slab_free+0x3c/0x50 [ 21.673700] kfre ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39825\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file. Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39826\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths. For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues. This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39827\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock. This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of rose_neigh->use when rose_neigh->count is incremented or decremented. This patch also modifies rose_rt_free(), rose_rt_device_down() and rose_clear_route() to properly release references to rose_neigh objects before freeing a rose_node through rose_remove_node(). These changes ensure rose_neigh structures are properly freed only when all references, including those from rose_node structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39828\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). syzbot reported the splat below. [0] When atmtcp_v_open() or atmtcp_v_close() is called via connect() or close(), atmtcp_send_control() is called to send an in-kernel special message. The message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length. Also, a pointer of struct atm_vcc is set to atmtcp_control.vcc. The notable thing is struct atmtcp_control is uAPI but has a space for an in-kernel pointer. struct atmtcp_control { struct atmtcp_hdr hdr; /* must be first */ ... atm_kptr_t vcc; /* both directions */ ... } __ATM_API_ALIGN; typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t; The special message is processed in atmtcp_recv_control() called from atmtcp_c_send(). atmtcp_c_send() is vcc->dev->ops->send() and called from 2 paths: 1. .ndo_start_xmit() (vcc->send() == atm_send_aal0()) 2. vcc_sendmsg() The problem is sendmsg() does not validate the message length and userspace can abuse atmtcp_recv_control() to overwrite any kptr by atmtcp_control. Let's add a new ->pre_send() hook to validate messages from sendmsg(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI KASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f] CPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline] RIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297 Code: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c RSP: 0018:ffffc90003f5f810 EFLAGS: 00010203 RAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c RBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd R10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000 R13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff FS: 00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0 Call Trace: vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8d7e96a4a9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9 RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005 RBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac R13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250 Modules linked in:\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39835\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: xfs: do not propagate ENODATA disk errors into xattr code ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code; namely, that the requested attribute name could not be found. However, a medium error from disk may also return ENODATA. At best, this medium error may escape to userspace as \"attribute not found\" when in fact it's an IO (disk) error. At worst, we may oops in xfs_attr_leaf_get() when we do: error = xfs_attr_leaf_hasname(args, &bp); if (error == -ENOATTR) { xfs_trans_brelse(args->trans, bp); return error; } because an ENODATA/ENOATTR error from disk leaves us with a null bp, and the xfs_trans_brelse will then null-deref it. As discussed on the list, we really need to modify the lower level IO functions to trap all disk errors and ensure that we don't let unique errors like this leak up into higher xfs functions - many like this should be remapped to EIO. However, this patch directly addresses a reported bug in the xattr code, and should be safe to backport to stable kernels. A larger-scope patch to handle more unique errors at lower levels can follow later. (Note, prior to 07120f1abdff we did not oops, but we did return the wrong error code to userspace.)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39838\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash. This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and returns NULL early to prevent dereferencing NULL pointer. Found by Linux Verification Center (linuxtesting.org) with SVACE\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39839\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39841\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF. Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39842\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already been executed in ocfs2_dismount_volume(), so osb->journal must be NULL. Therefore, the following calltrace will inevitably fail when it reaches jbd2_journal_release_jbd_inode(). ocfs2_dismount_volume()-> ocfs2_delete_osb()-> ocfs2_free_slot_info()-> __ocfs2_free_slot_info()-> evict()-> ocfs2_evict_inode()-> ocfs2_clear_inode()-> jbd2_journal_release_jbd_inode(osb->journal->j_journal, Adding osb->journal checks will prevent null-ptr-deref during the above execution path.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39843\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but when enabled CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare, and try to hold the per_cpu(hrtimer_bases)[n].lock. Avoid deadlock caused by implicitly waking up kswapd by passing in allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the debug_objects_fill_pool() case. Inside stack depot they are processed by gfp_nested_mask(). Since ___slab_alloc() has preemption disabled, we mask out __GFP_DIRECT_RECLAIM from the flags there. The oops looks something like: BUG: spinlock recursion on CPU#3, swapper/3/0 lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3 Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT) Call trace: spin_bug+0x0 _raw_spin_lock_irqsave+0x80 hrtimer_try_to_cancel+0x94 task_contending+0x10c enqueue_dl_entity+0x2a4 dl_server_start+0x74 enqueue_task_fair+0x568 enqueue_task+0xac do_activate_task+0x14c ttwu_do_activate+0xcc try_to_wake_up+0x6c8 default_wake_function+0x20 autoremove_wake_function+0x1c __wake_up+0xac wakeup_kswapd+0x19c wake_all_kswapds+0x78 __alloc_pages_slowpath+0x1ac __alloc_pages_noprof+0x298 stack_depot_save_flags+0x6b0 stack_depot_save+0x14 set_track_prepare+0x5c ___slab_alloc+0xccc __kmalloc_cache_noprof+0x470 __set_page_owner+0x2bc post_alloc_hook[jt]+0x1b8 prep_new_page+0x28 get_page_from_freelist+0x1edc __alloc_pages_noprof+0x13c alloc_slab_page+0x244 allocate_slab+0x7c ___slab_alloc+0x8e8 kmem_cache_alloc_noprof+0x450 debug_objects_fill_pool+0x22c debug_object_activate+0x40 enqueue_hrtimer[jt]+0xdc hrtimer_start_range_ns+0x5f8 ...\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39844\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm: move page table sync declarations to linux/pgtable.h During our internal testing, we started observing intermittent boot failures when the machine uses 4-level paging and has a large amount of persistent memory: BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] It turns out that the kernel panics while initializing vmemmap (struct page array) when the vmemmap region spans two PGD entries, because the new PGD entry is only installed in init_mm.pgd, but not in the page tables of other tasks. And looking at __populate_section_memmap(): if (vmemmap_can_optimize(altmap, pgmap)) // does not sync top level page tables r = vmemmap_populate_compound_pages(pfn, start, end, nid, pgmap); else // sync top level page tables in x86 r = vmemmap_populate(start, end, nid, altmap); In the normal path, vmemmap_populate() in arch/x86/mm/init_64.c synchronizes the top level page table (See commit 9b861528a801 (\"x86-64, mem: Update all PGDs for direct mapping and vmemmap mapping changes\")) so that all tasks in the system can see the new vmemmap area. However, when vmemmap_can_optimize() returns true, the optimized path skips synchronization of top-level page tables. This is because vmemmap_populate_compound_pages() is implemented in core MM code, which does not handle synchronization of the top-level page tables. Instead, the core MM has historically relied on each architecture to perform this synchronization manually. We're not the first party to encounter a crash caused by not-sync'd top level page tables: earlier this year, Gwan-gyeong Mun attempted to address the issue [1] [2] after hitting a kernel panic when x86 code accessed the vmemmap area before the corresponding top-level entries were synced. At that time, the issue was believed to be triggered only when struct page was enlarged for debugging purposes, and the patch did not get further updates. It turns out that current approach of relying on each arch to handle the page table sync manually is fragile because 1) it's easy to forget to sync the top level page table, and 2) it's also easy to overlook that the kernel should not access the vmemmap and direct mapping areas before the sync. # The solution: Make page table sync more code robust and harder to miss To address this, Dave Hansen suggested [3] [4] introducing {pgd,p4d}_populate_kernel() for updating kernel portion of the page tables and allow each architecture to explicitly perform synchronization when installing top-level entries. With this approach, we no longer need to worry about missing the sync step, reducing the risk of future regressions. The new interface reuses existing ARCH_PAGE_TABLE_SYNC_MASK, PGTBL_P*D_MODIFIED and arch_sync_kernel_mappings() facility used by vmalloc and ioremap to synchronize page tables. pgd_populate_kernel() looks like this: static inline void pgd_populate_kernel(unsigned long addr, pgd_t *pgd, p4d_t *p4d) { pgd_populate(&init_mm, pgd, p4d); if (ARCH_PAGE_TABLE_SYNC_MASK & PGTBL_PGD_MODIFIED) arch_sync_kernel_mappings(addr, addr); } It is worth noting that vmalloc() and apply_to_range() carefully synchronizes page tables by calling p*d_alloc_track() and arch_sync_kernel_mappings(), and thus they are not affected by ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39845\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() Define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to ensure page tables are properly synchronized when calling p*d_populate_kernel(). For 5-level paging, synchronization is performed via pgd_populate_kernel(). In 4-level paging, pgd_populate() is a no-op, so synchronization is instead performed at the P4D level via p4d_populate_kernel(). This fixes intermittent boot failures on systems using 4-level paging and a large amount of persistent memory: BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] It also fixes a crash in vmemmap_set_pmd() caused by accessing vmemmap before sync_global_pgds() [1]: BUG: unable to handle page fault for address: ffffeb3ff1200000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: Oops: 0002 [#1] PREEMPT SMP NOPTI Tainted: [W]=WARN RIP: 0010:vmemmap_set_pmd+0xff/0x230 vmemmap_populate_hugepages+0x176/0x180 vmemmap_populate+0x34/0x80 __populate_section_memmap+0x41/0x90 sparse_add_section+0x121/0x3e0 __add_pages+0xba/0x150 add_pages+0x1d/0x70 memremap_pages+0x3dc/0x810 devm_memremap_pages+0x1c/0x60 xe_devm_add+0x8b/0x100 [xe] xe_tile_init_noalloc+0x6a/0x70 [xe] xe_device_probe+0x48c/0x740 [xe] [... snip ...]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39846\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() In __iodyn_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource(). Fix this bug by adding a check of res.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39847\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ppp: fix memory leak in pad_compress_skb If alloc_skb() fails in pad_compress_skb(), it returns NULL without releasing the old skb. The caller does: skb = pad_compress_skb(ppp, skb); if (!skb) goto drop; drop: kfree_skb(skb); When pad_compress_skb() returns NULL, the reference to the old skb is lost and kfree_skb(skb) ends up doing nothing, leading to a memory leak. Align pad_compress_skb() semantics with realloc(): only free the old skb if allocation and compression succeed. At the call site, use the new_skb variable so the original skb is not lost when pad_compress_skb() fails.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-772 Missing Release of Resource after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39848\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d (\"net: introduce per netns packet chains\"). skb->dev becomes NULL and we crash in __netif_receive_skb_core(). Before above commit, different kind of bugs or corruptions could happen without a major crash. But the root cause is that ax25_kiss_rcv() can queue/mangle input skb without checking if this skb is shared or not. Many thanks to Bernard Pidoux for his help, diagnosis and tests. We had a similar issue years ago fixed with commit 7aaed57c5c28 (\"phonet: properly unshare skbs in phonet_rcv()\").\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39849\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checking.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39853\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. Fix this by using list_first_entry_or_null instead of list_first_entry.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39857\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G OE 6.17.0-rc2+ #9 NONE Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Workqueue: smc_hs_wq smc_listen_work [smc] RIP: 0010:smc_ib_is_sg_need_sync+0x9e/0xd0 [smc] ... Call Trace: smcr_buf_map_link+0x211/0x2a0 [smc] __smc_buf_create+0x522/0x970 [smc] smc_buf_create+0x3a/0x110 [smc] smc_find_rdma_v2_device_serv+0x18f/0x240 [smc] ? smc_vlan_by_tcpsk+0x7e/0xe0 [smc] smc_listen_find_device+0x1dd/0x2b0 [smc] smc_listen_work+0x30f/0x580 [smc] process_one_work+0x18c/0x340 worker_thread+0x242/0x360 kthread+0xe7/0x220 ret_from_fork+0x13a/0x160 ret_from_fork_asm+0x1a/0x30 If the software RoCE device is used, ibdev->dma_device is a null pointer. As a result, the problem occurs. Null pointer detection is added to prevent problems.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39860\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the \"Freed by task\" part. Let's call l2cap_sock_cleanup_listen() under lock_sock() in l2cap_sock_release(). [0]: BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 Read of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995 CPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 spin_lock_bh include/linux/spinlock.h:356 [inline] release_sock+0x21/0x220 net/core/sock.c:3746 bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2accf8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f R10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c R13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490 Allocated by task 5326: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4365 [inline] __kmalloc_nopro ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39864\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f (\"cfg80211: track hidden SSID networks properly\"), adjust cfg80211_update_known_bss() to free the last beacon frame elements only if they're not shared via the corresponding 'hidden_beacon_bss' pointer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39865\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer dereference in tee_shm_put tee_shm_put have NULL pointer dereference: __optee_disable_shm_cache --> shm = reg_pair_to_ptr(...);//shm maybe return NULL tee_shm_free(shm); --> tee_shm_put(shm);//crash Add check in tee_shm_put to fix it. panic log: Unable to handle kernel paging request at virtual address 0000000000100cca Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 [0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- 6.6.0-39-generic #38 Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 10/26/2022 pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tee_shm_put+0x24/0x188 lr : tee_shm_free+0x14/0x28 sp : ffff001f98f9faf0 x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca Call trace: tee_shm_put+0x24/0x188 tee_shm_free+0x14/0x28 __optee_disable_shm_cache+0xa8/0x108 optee_shutdown+0x28/0x38 platform_shutdown+0x28/0x40 device_shutdown+0x144/0x2b0 kernel_power_off+0x3c/0x80 hibernate+0x35c/0x388 state_store+0x64/0x80 kobj_attr_store+0x14/0x28 sysfs_kf_write+0x48/0x60 kernfs_fop_write_iter+0x128/0x1c0 vfs_write+0x270/0x370 ksys_write+0x6c/0x100 __arm64_sys_write+0x20/0x30 invoke_syscall+0x4c/0x120 el0_svc_common.constprop.0+0x44/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x24/0x88 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x14c/0x15\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39866\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mark_inode_dirty+0x124/0x418 lr : __mark_inode_dirty+0x118/0x418 sp : ffffffc08c9dbbc0 ........ Call trace: __mark_inode_dirty+0x124/0x418 generic_update_time+0x4c/0x60 file_modified+0xcc/0xd0 ext4_buffered_write_iter+0x58/0x124 ext4_file_write_iter+0x54/0x704 vfs_write+0x1c0/0x308 ksys_write+0x74/0x10c __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x40/0xe4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x194/0x198 Root cause is: systemd-random-seed kworker ---------------------------------------------------------------------- ___mark_inode_dirty inode_switch_wbs_work_fn spin_lock(&inode->i_lock); inode_attach_wb locked_inode_to_wb_and_lock_list get inode->i_wb spin_unlock(&inode->i_lock); spin_lock(&wb->list_lock) spin_lock(&inode->i_lock) inode_io_list_move_locked spin_unlock(&wb->list_lock) spin_unlock(&inode->i_lock) spin_lock(&old_wb->list_lock) inode_do_switch_wbs spin_lock(&inode->i_lock) inode->i_wb = new_wb spin_unlock(&inode->i_lock) spin_unlock(&old_wb->list_lock) wb_put_many(old_wb, nr_switched) cgwb_release old wb released wb_wakeup_delayed() accesses wb, then trigger the use-after-free issue Fix this race condition by holding inode spinlock until wb_wakeup_delayed() finished.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-40300\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest. Userspace can additionally be protected by flushing the branch predictors after a VMexit. Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and userspace will incur the most overhead from the new IBPB. This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is doubled up: one at context switch and another before running userspace. The intent is to integrate and optimize these cases post-embargo. [ dhansen: elaborate on suboptimal IBPB solution ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-43368\n<div class=\"csaf-accordion-content\">\n\nA use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-47219\n<div class=\"csaf-accordion-content\">\n\nIn GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n8.1\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-48989\n<div class=\"csaf-accordion-content\">\n\nImproper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-404 Improper Resource Shutdown or Release\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-53057\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-284 Improper Access Control\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-53066\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-55752\n<div class=\"csaf-accordion-content\">\n\nRelative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-23 Relative Path Traversal\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-55754\n<div class=\"csaf-accordion-content\">\n\nImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n9.6\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-61748\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-284 Improper Access Control\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.7\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-61795\n<div class=\"csaf-accordion-content\">\n\nImproper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-404 Improper Resource Shutdown or Release\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-2673\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21925\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.8\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21932\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.4\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21933\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.1\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21945\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-400 Uncontrolled Resource Consumption\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21947\n<div class=\"csaf-accordion-content\">\n\nVulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.1\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-22924\n<div class=\"csaf-accordion-content\">\n\nThe affected application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion conditions. This could allow an attacker to disrupt normal operations or perform unauthorized actions, potentially impacting system availability and integrity.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-306 Missing Authentication for Critical Function\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n9.1\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-22925\n<div class=\"csaf-accordion-content\">\n\nThe affected application is susceptible to resource exhaustion when subjected to high volume of TCP SYN packets This could allow an attacker to render the service unavailable and cause denial-of-service conditions by overwhelming system resources.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28387\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage. By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable. The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records. No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28388\n<div class=\"csaf-accordion-content\">\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28389\n<div class=\"csaf-accordion-content\">\n\nIssue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28390\n<div class=\"csaf-accordion-content\">\n\nIssue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-31789\n<div class=\"csaf-accordion-content\">\n\nIssue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the size of the buffer needed for the result is calculated as multiplication of the input length by 3. On 32 bit platforms, this multiplication may overflow resulting in the allocation of a smaller buffer and a heap buffer overflow. Applications and services that print or log contents of untrusted X.509 certificates are vulnerable to this issue. As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-31790\n<div class=\"csaf-accordion-content\">\n\nIssue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-754 Improper Check for Unusual or Exceptional Conditions\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n</div>\n\n\n\nAcknowledgments\n\n\n\nSiemens ProductCERT reported these vulnerabilities to CISA.\n\n\n\n\nGeneral Recommendations\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\n\n\nAdditional Resources\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories\n\n\n\nTerms of Use\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.\n\n\n\nLegal Notice and Terms of Use\n\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).\n\n\n\nRecommended Practices\n\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.\n\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.\n\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.\n\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.\n\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\n\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\n\n\n\nAdvisory Conversion Disclaimer\n\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-032379 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.\n\nRevision History\n\n\n\nInitial Release Date: 2026-05-12\n\n\n\n\n\nDate\nRevision\nSummary\n\n\n\n\n2026-05-12\n1\nPublication Date\n\n\n2026-05-14\n2\nInitial CISA Republication of Siemens ProductCERT SSA-032379 advisory\n\n\n\n\n\n\nLegal Notice and Terms of Use", "creation_timestamp": "2026-05-14T10:00:00.000000Z"}, {"uuid": "a9267eff-237b-41b0-9f90-305e02c8614a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28390", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-134-10", "content": "View CSAF\n\nSummary\n\nSIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.\n\nThe following versions of Siemens SIMATIC are affected:\n\n\n\nSIMATIC CN 4100 vers:intdot/<5.0 \n\n<div class=\"csaf-table\">\n\n\n\n\nCVSS\nVendor\nEquipment\nVulnerabilities\n\n\n\n\nv3 9.6\nSiemens\nSiemens SIMATIC\nNULL Pointer Dereference, Reachable Assertion, Use After Free, Out-of-bounds Write, Integer Overflow or Wraparound, Allocation of Resources Without Limits or Throttling, Out-of-bounds Read, Covert Timing Channel, Stack-based Buffer Overflow, Inefficient Algorithmic Complexity, Missing Release of Memory after Effective Lifetime, Improper Restriction of Operations within the Bounds of a Memory Buffer, Improper Input Validation, Improper Locking, Uncontrolled Recursion, Buffer Access with Incorrect Length Value, Race Condition within a Thread, Missing Synchronization, Use of Uninitialized Resource, Double Free, Missing Release of Resource after Effective Lifetime, Loop with Unreachable Exit Condition ('Infinite Loop'), Improper Update of Reference Count, Improper Control of a Resource Through its Lifetime, Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'), Unexpected Status Code or Return Value, Divide By Zero, Improper Validation of Specified Index, Position, or Offset in Input, Comparison Using Wrong Factors, Observable Timing Discrepancy, Improper Validation of Syntactic Correctness of Input, Deadlock, Signal Handler Race Condition, Improper Following of Specification by Caller, Improper Check for Dropped Privileges, Transmission of Private Resources into a New Sphere ('Resource Leak'), Improper Resource Shutdown or Release, Improper Access Control, Exposure of Sensitive Information to an Unauthorized Actor, Relative Path Traversal, Improper Neutralization of Escape, Meta, or Control Sequences, Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade'), Uncontrolled Resource Consumption, Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Missing Authentication for Critical Function, Improper Check for Unusual or Exceptional Conditions\n\n\n\n</div>\n\nBackground\n\n\n\nCritical Infrastructure Sectors: Critical Manufacturing\n\nCountries/Areas Deployed: Worldwide\n\nCompany Headquarters Location: Germany\n\n\n\n\nVulnerabilities\n<div class=\"csaf-accordion\">\n\nExpand All +\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-47704\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check link_res->hpo_dp_link_enc before using it [WHAT & HOW] Functions dp_enable_link_phy and dp_disable_link_phy can pass link_res without initializing hpo_dp_link_enc and it is necessary to check for null before dereferencing. This fixes 2 FORWARD_NULL issues reported by Coverity.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-57924\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding file handles is usually performed by a filesystem >encode_fh() method that may fail for various reasons. The legacy users of exportfs_encode_fh(), namely, nfsd and name_to_handle_at(2) syscall are ready to cope with the possibility of failure to encode a file handle. There are a few other users of exportfs_encode_{fh,fid}() that currently have a WARN_ON() assertion when ->encode_fh() fails. Relax those assertions because they are wrong. The second linked bug report states commit 16aac5ad1fa9 (\"ovl: support encoding non-decodable file handles\") in v6.6 as the regressing commit, but this is not accurate. The aforementioned commit only increases the chances of the assertion and allows triggering the assertion with the reproducer using overlayfs, inotify and drop_caches. Triggering this assertion was always possible with other filesystems and other reasons of ->encode_fh() failures and more particularly, it was also possible with the exact same reproducer using overlayfs that is mounted with options index=on,nfs_export=on also on kernels < v6.6. Therefore, I am not listing the aforementioned commit as a Fixes commit. Backport hint: this patch will have a trivial conflict applying to v6.6.y, and other trivial conflicts applying to stable kernels < v6.6.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-617 Reachable Assertion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2024-58240\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result. We should preferably also use a separate crypto_wait. I'm not seeing a UAF as I did in the past, I think aec7961916f3 (\"tls: fix race between async notify and socket close\") took care of it. This will make the next fix easier.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.3\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-6021\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-6052\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in how GLib\u2019s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doesn\u2019t. As a result, data may be written past the end of the allocated memory, leading to crashes or memory corruption.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-190 Integer Overflow or Wraparound\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.7\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-7425\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-8916\n<div class=\"csaf-accordion-content\">\n\nAllocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcpkix on All (API modules), Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bouncy Castle Inc. BCPKIX FIPS bcpkix-fips on All (API modules) allows Excessive Allocation. This vulnerability is associated with program files https://github.Com/bcgit/bc-java/blob/main/pkix/src/main/java/org/bouncycastle/pkix/jcajce/PKIXCertPathReviewer.Java, https://github.Com/bcgit/bc-java/blob/main/prov/src/main/java/org/bouncycastle/x509/PKIXCertPathReviewer.Java. This issue affects BC Java: from 1.44 through 1.78; BC Java: from 1.44 through 1.78; BCPKIX FIPS: from 1.0.0 through 1.0.7, from 2.0.0 through 2.0.7.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9230\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9231\n<div class=\"csaf-accordion-content\">\n\nIssue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing side-channel in SM2 signature computations on 64 bit ARM platforms could allow recovering the private key by an attacker.. While remote key recovery over a network was not attempted by the reporter, timing measurements revealed a timing signal which may allow such an attack. OpenSSL does not directly support certificates with SM2 keys in TLS, and so this CVE is not relevant in most TLS contexts. However, given that it is possible to add support for such certificates via a custom provider, coupled with the fact that in such a custom provider context the private key may be recoverable via remote timing measurements, we consider this to be a Moderate severity issue. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as SM2 is not an approved algorithm.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-385 Covert Timing Channel\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9232\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-9820\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label longer than expected is processed, the function writes past the end of a fixed-size stack buffer. This programming error can cause the application using GnuTLS to crash or, in certain conditions, be exploited for code execution. As a result, systems or applications relying on GnuTLS may be vulnerable to a denial of service or local privilege escalation attacks.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-121 Stack-based Buffer Overflow\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-14831\n<div class=\"csaf-accordion-content\">\n\nA flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-407 Inefficient Algorithmic Complexity\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-23143\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. When I ran the repro [0] and waited a few seconds, I observed two LOCKDEP splats: a warning immediately followed by a null-ptr-deref. [1] Reproduction Steps: 1) Mount CIFS 2) Add an iptables rule to drop incoming FIN packets for CIFS 3) Unmount CIFS 4) Unload the CIFS module 5) Remove the iptables rule At step 3), the CIFS module calls sock_release() for the underlying TCP socket, and it returns quickly. However, the socket remains in FIN_WAIT_1 because incoming FIN packets are dropped. At this point, the module's refcnt is 0 while the socket is still alive, so the following rmmod command succeeds. # ss -tan State Recv-Q Send-Q Local Address:Port Peer Address:Port FIN-WAIT-1 0 477 10.0.2.15:51062 10.0.0.137:445 # lsmod | grep cifs cifs 1159168 0 This highlights a discrepancy between the lifetime of the CIFS module and the underlying TCP socket. Even after CIFS calls sock_release() and it returns, the TCP socket does not die immediately in order to close the connection gracefully. While this is generally fine, it causes an issue with LOCKDEP because CIFS assigns a different lock class to the TCP socket's sk->sk_lock using sock_lock_init_class_and_name(). Once an incoming packet is processed for the socket or a timer fires, sk->sk_lock is acquired. Then, LOCKDEP checks the lock context in check_wait_context(), where hlock_class() is called to retrieve the lock class. However, since the module has already been unloaded, hlock_class() logs a warning and returns NULL, triggering the null-ptr-deref. If LOCKDEP is enabled, we must ensure that a module calling sock_lock_init_class_and_name() (CIFS, NFS, etc) cannot be unloaded while such a socket is still alive to prevent this issue. Let's hold the module reference in sock_lock_init_class_and_name() and release it when the socket is freed in sk_prot_free(). Note that sock_lock_init() clears sk->sk_owner for svc_create_socket() that calls sock_lock_init_class_and_name() for a listening socket, which clones a socket by sk_clone_lock() without GFP_ZERO. [0]: CIFS_SERVER=\"10.0.0.137\" CIFS_PATH=\"//${CIFS_SERVER}/Users/Administrator/Desktop/CIFS_TEST\" DEV=\"enp0s3\" CRED=\"/root/WindowsCredential.txt\" MNT=$(mktemp -d /tmp/XXXXXX) mount -t cifs ${CIFS_PATH} ${MNT} -o vers=3.0,credentials=${CRED},cache=none,echo_interval=1 iptables -A INPUT -s ${CIFS_SERVER} -j DROP for i in $(seq 10); do umount ${MNT} rmmod cifs sleep 1 done rm -r ${MNT} iptables -D INPUT -s ${CIFS_SERVER} -j DROP [1]: DEBUG_LOCKS_WARN_ON(1) WARNING: CPU: 10 PID: 0 at kernel/locking/lockdep.c:234 hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223) Modules linked in: cifs_arc4 nls_ucs2_utils cifs_md4 [last unloaded: cifs] CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Not tainted 6.14.0 #36 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:hlock_class (kernel/locking/lockdep.c:234 kernel/locking/lockdep.c:223) ... Call Trace: __lock_acquire (kernel/locking/lockdep.c:4853 kernel/locking/lockdep.c:5178) lock_acquire (kernel/locking/lockdep.c:469 kernel/locking/lockdep.c:5853 kernel/locking/lockdep.c:5816) _raw_spin_lock_nested (kernel/locking/spinlock.c:379) tcp_v4_rcv (./include/linux/skbuff.h:1678 ./include/net/tcp.h:2547 net/ipv4/tcp_ipv4.c:2350) ... BUG: kernel NULL pointer dereference, address: 00000000000000c4 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 10 UID: 0 PID: 0 Comm: swapper/10 Tainted: G W 6.14.0 #36 Tainted: [W]=WARN Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:__lock_acquire (kernel/ ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-23160\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initialization On Mediatek devices with a system companion processor (SCP) the mtk_scp structure has to be removed explicitly to avoid a resource leak. Free the structure in case the allocation of the firmware structure fails during the firmware initialization.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-31257\n<div class=\"csaf-accordion-content\">\n\nThis issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-37931\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: adjust subpage bit start based on sectorsize When running machines with 64k page size and a 16k nodesize we started seeing tree log corruption in production. This turned out to be because we were not writing out dirty blocks sometimes, so this in fact affects all metadata writes. When writing out a subpage EB we scan the subpage bitmap for a dirty range. If the range isn't dirty we do bit_start++; to move onto the next bit. The problem is the bitmap is based on the number of sectors that an EB has. So in this case, we have a 64k pagesize, 16k nodesize, but a 4k sectorsize. This means our bitmap is 4 bits for every node. With a 64k page size we end up with 4 nodes per page. To make this easier this is how everything looks [0 16k 32k 48k ] logical address [0 4 8 12 ] radix tree offset [ 64k page ] folio [ 16k eb ][ 16k eb ][ 16k eb ][ 16k eb ] extent buffers [ | | | | | | | | | | | | | | | | ] bitmap Now we use all of our addressing based on fs_info->sectorsize_bits, so as you can see the above our 16k eb->start turns into radix entry 4. When we find a dirty range for our eb, we correctly do bit_start += sectors_per_node, because if we start at bit 0, the next bit for the next eb is 4, to correspond to eb->start 16k. However if our range is clean, we will do bit_start++, which will now put us offset from our radix tree entries. In our case, assume that the first time we check the bitmap the block is not dirty, we increment bit_start so now it == 1, and then we loop around and check again. This time it is dirty, and we go to find that start using the following equation start = folio_start + bit_start * fs_info->sectorsize; so in the case above, eb->start 0 is now dirty, and we calculate start as 0 + 1 * fs_info->sectorsize = 4096 4096 >> 12 = 1 Now we're looking up the radix tree for 1, and we won't find an eb. What's worse is now we're using bit_start == 1, so we do bit_start += sectors_per_node, which is now 5. If that eb is dirty we will run into the same thing, we will look at an offset that is not populated in the radix tree, and now we're skipping the writeout of dirty extent buffers. The best fix for this is to not use sectorsize_bits to address nodes, but that's a larger change. Since this is a fs corruption problem fix it simply by always using sectors_per_node to increment the start bit.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-37968\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: light: opt3001: fix deadlock due to concurrent flag access The threaded IRQ function in this driver is reading the flag twice: once to lock a mutex and once to unlock it. Even though the code setting the flag is designed to prevent it, there are subtle cases where the flag could be true at the mutex_lock stage and false at the mutex_unlock stage. This results in the mutex not being unlocked, resulting in a deadlock. Fix it by making the opt3001_irq() code generally more robust, reading the flag into a variable and using the variable value at both stages.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38322\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400: 0000 CPU: 23 UID: 0 PID: 0 Comm: swapper/23 Tainted: [W]=WARN Hardware name: Dell Inc. Precision 9660/0VJ762 RIP: 0010:native_read_pmc+0x7/0x40 Code: cc e8 8d a9 01 00 48 89 03 5b cd cc cc cc cc 0f 1f ... RSP: 000:fffb03100273de8 EFLAGS: 00010046 .... Call Trace: icl_update_topdown_event+0x165/0x190 ? ktime_get+0x38/0xd0 intel_pmu_read_event+0xf9/0x210 __perf_event_read+0xf9/0x210 CPUs 16-23 are E-core CPUs that don't support the perf metrics feature. The icl_update_topdown_event() should not be invoked on these CPUs. It's a regression of commit: f9bdf1f95339 (\"perf/x86/intel: Avoid disable PMU if !cpuc->enabled in sample read\") The bug introduced by that commit is that the is_topdown_event() function is mistakenly used to replace the is_topdown_count() call to check if the topdown functions for the perf metrics feature should be invoked. Fix it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38347\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on ino and xnid syzbot reported a f2fs bug as below: INFO: task syz-executor140:5308 blocked for more than 143 seconds. Not tainted 6.14.0-rc7-syzkaller-00069-g81e4f8d68c66 #0 \"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\" disables this message. task:syz-executor140 state:D stack:24016 pid:5308 tgid:5308 ppid:5306 task_flags:0x400140 flags:0x00000006 Call Trace: context_switch kernel/sched/core.c:5378 [inline] __schedule+0x190e/0x4c90 kernel/sched/core.c:6765 __schedule_loop kernel/sched/core.c:6842 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6857 io_schedule+0x8d/0x110 kernel/sched/core.c:7690 folio_wait_bit_common+0x839/0xee0 mm/filemap.c:1317 __folio_lock mm/filemap.c:1664 [inline] folio_lock include/linux/pagemap.h:1163 [inline] __filemap_get_folio+0x147/0xb40 mm/filemap.c:1917 pagecache_get_page+0x2c/0x130 mm/folio-compat.c:87 find_get_page_flags include/linux/pagemap.h:842 [inline] f2fs_grab_cache_page+0x2b/0x320 fs/f2fs/f2fs.h:2776 __get_node_page+0x131/0x11b0 fs/f2fs/node.c:1463 read_xattr_block+0xfb/0x190 fs/f2fs/xattr.c:306 lookup_all_xattrs fs/f2fs/xattr.c:355 [inline] f2fs_getxattr+0x676/0xf70 fs/f2fs/xattr.c:533 __f2fs_get_acl+0x52/0x870 fs/f2fs/acl.c:179 f2fs_acl_create fs/f2fs/acl.c:375 [inline] f2fs_init_acl+0xd7/0x9b0 fs/f2fs/acl.c:418 f2fs_init_inode_metadata+0xa0f/0x1050 fs/f2fs/dir.c:539 f2fs_add_inline_entry+0x448/0x860 fs/f2fs/inline.c:666 f2fs_add_dentry+0xba/0x1e0 fs/f2fs/dir.c:765 f2fs_do_add_link+0x28c/0x3a0 fs/f2fs/dir.c:808 f2fs_add_link fs/f2fs/f2fs.h:3616 [inline] f2fs_mknod+0x2e8/0x5b0 fs/f2fs/namei.c:766 vfs_mknod+0x36d/0x3b0 fs/namei.c:4191 unix_bind_bsd net/unix/af_unix.c:1286 [inline] unix_bind+0x563/0xe30 net/unix/af_unix.c:1379 __sys_bind_socket net/socket.c:1817 [inline] __sys_bind+0x1e4/0x290 net/socket.c:1848 __do_sys_bind net/socket.c:1853 [inline] __se_sys_bind net/socket.c:1851 [inline] __x64_sys_bind+0x7a/0x90 net/socket.c:1851 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Let's dump and check metadata of corrupted inode, it shows its xattr_nid is the same to its i_ino. dump.f2fs -i 3 chaseyu.img.raw i_xattr_nid [0x 3 : 3] So that, during mknod in the corrupted directory, it tries to get and lock inode page twice, result in deadlock. - f2fs_mknod - f2fs_add_inline_entry - f2fs_get_inode_page --- lock dir's inode page - f2fs_init_acl - f2fs_acl_create(dir,..) - __f2fs_get_acl - f2fs_getxattr - lookup_all_xattrs - __get_node_page --- try to lock dir's inode page In order to fix this, let's add sanity check on ino and xnid.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38491\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mptcp: make fallback action and fallback decision atomic Syzkaller reported the following splat: WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 __mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 check_fully_established net/mptcp/options.c:982 [inline] WARNING: CPU: 1 PID: 7704 at net/mptcp/protocol.h:1223 mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Modules linked in: CPU: 1 UID: 0 PID: 7704 Comm: syz.3.1419 Not tainted 6.16.0-rc3-gbd5ce2324dba #20 PREEMPT(voluntary) Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:__mptcp_do_fallback net/mptcp/protocol.h:1223 [inline] RIP: 0010:mptcp_do_fallback net/mptcp/protocol.h:1244 [inline] RIP: 0010:check_fully_established net/mptcp/options.c:982 [inline] RIP: 0010:mptcp_incoming_options+0x21a8/0x2510 net/mptcp/options.c:1153 Code: 24 18 e8 bb 2a 00 fd e9 1b df ff ff e8 b1 21 0f 00 e8 ec 5f c4 fc 44 0f b7 ac 24 b0 00 00 00 e9 54 f1 ff ff e8 d9 5f c4 fc 90 <0f> 0b 90 e9 b8 f4 ff ff e8 8b 2a 00 fd e9 8d e6 ff ff e8 81 2a 00 RSP: 0018:ffff8880a3f08448 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff8880180a8000 RCX: ffffffff84afcf45 RDX: ffff888090223700 RSI: ffffffff84afdaa7 RDI: 0000000000000001 RBP: ffff888017955780 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880180a8910 R14: ffff8880a3e9d058 R15: 0000000000000000 FS: 00005555791b8500(0000) GS:ffff88811c495000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000110c2800b7 CR3: 0000000058e44000 CR4: 0000000000350ef0 Call Trace: tcp_reset+0x26f/0x2b0 net/ipv4/tcp_input.c:4432 tcp_validate_incoming+0x1057/0x1b60 net/ipv4/tcp_input.c:5975 tcp_rcv_established+0x5b5/0x21f0 net/ipv4/tcp_input.c:6166 tcp_v4_do_rcv+0x5dc/0xa70 net/ipv4/tcp_ipv4.c:1925 tcp_v4_rcv+0x3473/0x44a0 net/ipv4/tcp_ipv4.c:2363 ip_protocol_deliver_rcu+0xba/0x480 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2f1/0x500 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_local_deliver+0x1be/0x560 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:469 [inline] ip_rcv_finish net/ipv4/ip_input.c:447 [inline] NF_HOOK include/linux/netfilter.h:317 [inline] NF_HOOK include/linux/netfilter.h:311 [inline] ip_rcv+0x514/0x810 net/ipv4/ip_input.c:567 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:5975 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6088 process_backlog+0x301/0x1360 net/core/dev.c:6440 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7453 napi_poll net/core/dev.c:7517 [inline] net_rx_action+0xb44/0x1010 net/core/dev.c:7644 handle_softirqs+0x1d0/0x770 kernel/softirq.c:579 do_softirq+0x3f/0x90 kernel/softirq.c:480 __local_bh_enable_ip+0xed/0x110 kernel/softirq.c:407 local_bh_enable include/linux/bottom_half.h:33 [inline] inet_csk_listen_stop+0x2c5/0x1070 net/ipv4/inet_connection_sock.c:1524 mptcp_check_listen_stop.part.0+0x1cc/0x220 net/mptcp/protocol.c:2985 mptcp_check_listen_stop net/mptcp/mib.h:118 [inline] __mptcp_close+0x9b9/0xbd0 net/mptcp/protocol.c:3000 mptcp_close+0x2f/0x140 net/mptcp/protocol.c:3066 inet_release+0xed/0x200 net/ipv4/af_inet.c:435 inet6_release+0x4f/0x70 net/ipv6/af_inet6.c:487 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x402/0xb70 fs/file_table.c:465 task_work_run+0x150/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xd4 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38502\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: bpf: Fix oob access in cgroup local storage Lonial reported that an out-of-bounds access in cgroup local storage can be crafted via tail calls. Given two programs each utilizing a cgroup local storage with a different value size, and one program doing a tail call into the other. The verifier will validate each of the indivial programs just fine. However, in the runtime context the bpf_cg_run_ctx holds an bpf_prog_array_item which contains the BPF program as well as any cgroup local storage flavor the program uses. Helpers such as bpf_get_local_storage() pick this up from the runtime context: ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx); storage = ctx->prog_item->cgroup_storage[stype]; if (stype == BPF_CGROUP_STORAGE_SHARED) ptr = &READ_ONCE(storage->buf)->data[0]; else ptr = this_cpu_ptr(storage->percpu_buf); For the second program which was called from the originally attached one, this means bpf_get_local_storage() will pick up the former program's map, not its own. With mismatching sizes, this can result in an unintended out-of-bounds access. To fix this issue, we need to extend bpf_map_owner with an array of storage_cookie[] to match on i) the exact maps from the original program if the second program was using bpf_get_local_storage(), or ii) allow the tail call combination if the second program was not using any of the cgroup local storage maps.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38552\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between subflow fail and subflow creation We have races similar to the one addressed by the previous patch between subflow failing and additional subflow creation. They are just harder to trigger. The solution is similar. Use a separate flag to track the condition 'socket state prevent any additional subflow creation' protected by the fallback lock. The socket fallback makes such flag true, and also receiving or sending an MP_FAIL option. The field 'allow_infinite_fallback' is now always touched under the relevant lock, we can drop the ONCE annotation on write.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38614\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the depth of the resulting tree for two reasons: - They don't look upwards in the tree. - If there are multiple downwards paths of different lengths, only one of the paths is actually considered for the depth check since commit 28d82dc1c4ed (\"epoll: limit paths\"). Essentially, the current recursion depth check in ep_loop_check_proc() just serves to prevent it from recursing too deeply while checking for loops. A more thorough check is done in reverse_path_check() after the new graph edge has already been created; this checks, among other things, that no paths going upwards from any non-epoll file with a length of more than 5 edges exist. However, this check does not apply to non-epoll files. As a result, it is possible to recurse to a depth of at least roughly 500, tested on v6.15. (I am unsure if deeper recursion is possible; and this may have changed with commit 8c44dac8add7 (\"eventpoll: Fix priority inversion problem\").) To fix it: 1. In ep_loop_check_proc(), note the subtree depth of each visited node, and use subtree depths for the total depth calculation even when a subtree has already been visited. 2. Add ep_get_upwards_depth_proc() for similarly determining the maximum depth of an upwards walk. 3. In ep_loop_check(), use these values to limit the total path length between epoll nodes to EP_MAX_NESTS edges.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-674 Uncontrolled Recursion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38670\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: arm64/entry: Mask DAIF in cpu_switch_to(), call_on_irq_stack() `cpu_switch_to()` and `call_on_irq_stack()` manipulate SP to change to different stacks along with the Shadow Call Stack if it is enabled. Those two stack changes cannot be done atomically and both functions can be interrupted by SErrors or Debug Exceptions which, though unlikely, is very much broken : if interrupted, we can end up with mismatched stacks and Shadow Call Stack leading to clobbered stacks. In `cpu_switch_to()`, it can happen when SP_EL0 points to the new task, but x18 stills points to the old task's SCS. When the interrupt handler tries to save the task's SCS pointer, it will save the old task SCS pointer (x18) into the new task struct (pointed to by SP_EL0), clobbering it. In `call_on_irq_stack()`, it can happen when switching from the task stack to the IRQ stack and when switching back. In both cases, we can be interrupted when the SCS pointer points to the IRQ SCS, but SP points to the task stack. The nested interrupt handler pushes its return addresses on the IRQ SCS. It then detects that SP points to the task stack, calls `call_on_irq_stack()` and clobbers the task SCS pointer with the IRQ SCS pointer, which it will also use ! This leads to tasks returning to addresses on the wrong SCS, or even on the IRQ SCS, triggering kernel panics via CONFIG_VMAP_STACK or FPAC if enabled. This is possible on a default config, but unlikely. However, when enabling CONFIG_ARM64_PSEUDO_NMI, DAIF is unmasked and instead the GIC is responsible for filtering what interrupts the CPU should receive based on priority. Given the goal of emulating NMIs, pseudo-NMIs can be received by the CPU even in `cpu_switch_to()` and `call_on_irq_stack()`, possibly *very* frequently depending on the system configuration and workload, leading to unpredictable kernel panics. Completely mask DAIF in `cpu_switch_to()` and restore it when returning. Do the same in `call_on_irq_stack()`, but restore and mask around the branch. Mask DAIF even if CONFIG_SHADOW_CALL_STACK is not enabled for consistency of behaviour between all configurations. Introduce and use an assembly macro for saving and masking DAIF, as the existing one saves but only masks IF.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38676\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iommu/amd: Avoid stack buffer overflow from kernel cmdline While the kernel command line is considered trusted in most environments, avoid writing 1 byte past the end of \"acpiid\" if the \"str\" argument is maximum length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-805 Buffer Access with Incorrect Length Value\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38677\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-boundary access in dnode page As Jiaming Zhang reported: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x1c1/0x2a0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x17e/0x800 mm/kasan/report.c:480 kasan_report+0x147/0x180 mm/kasan/report.c:593 data_blkaddr fs/f2fs/f2fs.h:3053 [inline] f2fs_data_blkaddr fs/f2fs/f2fs.h:3058 [inline] f2fs_get_dnode_of_data+0x1a09/0x1c40 fs/f2fs/node.c:855 f2fs_reserve_block+0x53/0x310 fs/f2fs/data.c:1195 prepare_write_begin fs/f2fs/data.c:3395 [inline] f2fs_write_begin+0xf39/0x2190 fs/f2fs/data.c:3594 generic_perform_write+0x2c7/0x910 mm/filemap.c:4112 f2fs_buffered_write_iter fs/f2fs/file.c:4988 [inline] f2fs_file_write_iter+0x1ec8/0x2410 fs/f2fs/file.c:5216 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x546/0xa90 fs/read_write.c:686 ksys_write+0x149/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x3d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is in the corrupted image, there is a dnode has the same node id w/ its inode, so during f2fs_get_dnode_of_data(), it tries to access block address in dnode at offset 934, however it parses the dnode as inode node, so that get_dnode_addr() returns 360, then it tries to access page address from 360 + 934 * 4 = 4096 w/ 4 bytes. To fix this issue, let's add sanity check for node id of all direct nodes during f2fs_get_dnode_of_data().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38679\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: Fix OOB read due to missing payload bound check Currently, The event_seq_changed() handler processes a variable number of properties sent by the firmware. The number of properties is indicated by the firmware and used to iterate over the payload. However, the payload size is not being validated against the actual message length. This can lead to out-of-bounds memory access if the firmware provides a property count that exceeds the data available in the payload. Such a condition can result in kernel crashes or potential information leaks if memory beyond the buffer is accessed. Fix this by properly validating the remaining size of the payload before each property access and updating bounds accordingly as properties are parsed. This ensures that property parsing is safely bounded within the received message buffer and protects against malformed or malicious firmware behavior.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38680\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() The buffer length check before calling uvc_parse_format() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 bytes. This can lead to an out-of-bounds read if the buffer has exactly 3 bytes. Fix it by checking that the buffer has at least 4 bytes in uvc_parse_format().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38681\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() Memory hot remove unmaps and tears down various kernel page table regions as required. The ptdump code can race with concurrent modifications of the kernel page tables. When leaf entries are modified concurrently, the dump code may log stale or inconsistent information for a VA range, but this is otherwise not harmful. But when intermediate levels of kernel page table are freed, the dump code will continue to use memory that has been freed and potentially reallocated for another purpose. In such cases, the ptdump code may dereference bogus addresses, leading to a number of potential problems. To avoid the above mentioned race condition, platforms such as arm64, riscv and s390 take memory hotplug lock, while dumping kernel page table via the sysfs interface /sys/kernel/debug/kernel_page_tables. Similar race condition exists while checking for pages that might have been marked W+X via /sys/kernel/debug/kernel_page_tables/check_wx_pages which in turn calls ptdump_check_wx(). Instead of solving this race condition again, let's just move the memory hotplug lock inside generic ptdump_check_wx() which will benefit both the scenarios. Drop get_online_mems() and put_online_mems() combination from all existing platform ptdump code paths.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-366 Race Condition within a Thread\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38683\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, default_device_exit_batch() >> default_device_exit_net() is called. When netvsc NIC is moved back and registered to the default namespace, it automatically brings VF NIC back to the default namespace. This will cause the default_device_exit_net() >> for_each_netdev_safe loop unable to detect the list end, and hit NULL ptr: [ 231.449420] mana 7870:00:00.0 enP30832s1: Moved VF to namespace with: eth0 [ 231.449656] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 231.450246] #PF: supervisor read access in kernel mode [ 231.450579] #PF: error_code(0x0000) - not-present page [ 231.450916] PGD 17b8a8067 P4D 0 [ 231.451163] Oops: Oops: 0000 [#1] SMP NOPTI [ 231.451450] CPU: 82 UID: 0 PID: 1394 Comm: kworker/u768:1 Not tainted 6.16.0-rc4+ #3 VOLUNTARY [ 231.452042] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/21/2024 [ 231.452692] Workqueue: netns cleanup_net [ 231.452947] RIP: 0010:default_device_exit_batch+0x16c/0x3f0 [ 231.453326] Code: c0 0c f5 b3 e8 d5 db fe ff 48 85 c0 74 15 48 c7 c2 f8 fd ca b2 be 10 00 00 00 48 8d 7d c0 e8 7b 77 25 00 49 8b 86 28 01 00 00 <48> 8b 50 10 4c 8b 2a 4c 8d 62 f0 49 83 ed 10 4c 39 e0 0f 84 d6 00 [ 231.454294] RSP: 0018:ff75fc7c9bf9fd00 EFLAGS: 00010246 [ 231.454610] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 61c8864680b583eb [ 231.455094] RDX: ff1fa9f71462d800 RSI: ff75fc7c9bf9fd38 RDI: 0000000030766564 [ 231.455686] RBP: ff75fc7c9bf9fd78 R08: 0000000000000000 R09: 0000000000000000 [ 231.456126] R10: 0000000000000001 R11: 0000000000000004 R12: ff1fa9f70088e340 [ 231.456621] R13: ff1fa9f70088e340 R14: ffffffffb3f50c20 R15: ff1fa9f7103e6340 [ 231.457161] FS: 0000000000000000(0000) GS:ff1faa6783a08000(0000) knlGS:0000000000000000 [ 231.457707] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 231.458031] CR2: 0000000000000010 CR3: 0000000179ab2006 CR4: 0000000000b73ef0 [ 231.458434] Call Trace: [ 231.458600] [ 231.458777] ops_undo_list+0x100/0x220 [ 231.459015] cleanup_net+0x1b8/0x300 [ 231.459285] process_one_work+0x184/0x340 To fix it, move the ns change to a workqueue, and take rtnl_lock to avoid changing the netdev list when default_device_exit_net() is using it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-820 Missing Synchronization\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.2\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38684\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/sched: ets: use old 'nbands' while purging unused classes Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify() after recent changes from Lion [2]. The problem is: in ets_qdisc_change() we purge unused DWRR queues; the value of 'q->nbands' is the new one, and the cleanup should be done with the old one. The problem is here since my first attempts to fix ets_qdisc_change(), but it surfaced again after the recent qdisc len accounting fixes. Fix it purging idle DWRR queues before assigning a new value of 'q->nbands', so that all purge operations find a consistent configuration: - old 'q->nbands' because it's needed by ets_class_find() - old 'q->nstrict' because it's needed by ets_class_is_strict() BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 62 UID: 0 PID: 39457 Comm: tc Kdump: loaded Not tainted 6.12.0-116.el10.x86_64 #1 PREEMPT(voluntary) Hardware name: Dell Inc. PowerEdge R640/06DKY5, BIOS 2.12.2 07/09/2021 RIP: 0010:__list_del_entry_valid_or_report+0x4/0x80 Code: ff 4c 39 c7 0f 84 39 19 8e ff b8 01 00 00 00 c3 cc cc cc cc 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <48> 8b 17 48 8b 4f 08 48 85 d2 0f 84 56 19 8e ff 48 85 c9 0f 84 ab RSP: 0018:ffffba186009f400 EFLAGS: 00010202 RAX: 00000000000000d6 RBX: 0000000000000000 RCX: 0000000000000004 RDX: ffff9f0fa29b69c0 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffffffc12c2400 R08: 0000000000000008 R09: 0000000000000004 R10: ffffffffffffffff R11: 0000000000000004 R12: 0000000000000000 R13: ffff9f0f8cfe0000 R14: 0000000000100005 R15: 0000000000000000 FS: 00007f2154f37480(0000) GS:ffff9f269c1c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001530be001 CR4: 00000000007726f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ets_class_qlen_notify+0x65/0x90 [sch_ets] qdisc_tree_reduce_backlog+0x74/0x110 ets_qdisc_change+0x630/0xa40 [sch_ets] __tc_modify_qdisc.constprop.0+0x216/0x7f0 tc_modify_qdisc+0x7c/0x120 rtnetlink_rcv_msg+0x145/0x3f0 netlink_rcv_skb+0x53/0x100 netlink_unicast+0x245/0x390 netlink_sendmsg+0x21b/0x470 ____sys_sendmsg+0x39d/0x3d0 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xd0 do_syscall_64+0x7d/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f2155114084 Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 25 f0 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 RSP: 002b:00007fff1fd7a988 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000560ec063e5e0 RCX: 00007f2155114084 RDX: 0000000000000000 RSI: 00007fff1fd7a9f0 RDI: 0000000000000003 RBP: 00007fff1fd7aa60 R08: 0000000000000010 R09: 000000000000003f R10: 0000560ee9b3a010 R11: 0000000000000202 R12: 00007fff1fd7aae0 R13: 000000006891ccde R14: 0000560ec063e5e0 R15: 00007fff1fd7aad0 [1] https://lore.kernel.org/netdev/e08c7f4a6882f260011909a868311c6e9b54f3e4.1639153474.git.dcaratti@redhat.com/ [2] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.2\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38685\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible. As part of mapping it has to do resize of console according to frame buffer info. if this resize fails and returns from vc_do_resize() and continues further. At this point console and new frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the screen at later stages where vc_data is related to previous frame buffer and frame buffer info and display vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fast_imageblit(). This bheviour is excepted only when fg_console is equal to requested console which is a visible console and updates screen with invalid struct references in fbcon_putcs().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38687\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the wait_queue_head inside of it. This can cause a use-after-free when the poll entries are later triggered or removed, as the memory for the wait_queue_head has been freed. We need to check there are no tasks queued on any of the subdevices' wait queues before allowing the device to be detached by the `COMEDI_DEVCONFIG` ioctl. Tasks will read-lock `dev->attach_lock` before adding themselves to the subdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl handler by write-locking `dev->attach_lock` before checking that all of the subdevices are safe to be deleted. This includes testing for any sleepers on the subdevices' wait queues. It remains locked until the device has been detached. This requires the `comedi_device_detach()` function to be refactored slightly, moving the bulk of it into new function `comedi_device_detach_locked()`. Note that the refactor of `comedi_device_detach()` results in `comedi_device_cancel_all()` now being called while `dev->attach_lock` is write-locked, which wasn't the case previously, but that does not matter. Thanks to Jens Axboe for diagnosing the problem and co-developing this patch.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38691\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the \"layoutupdate_pages\" page array is initialized only after the retry loop. But ext_tree_free_commitdata() is called on every iteration and tries to put pages in the array, thus dereferencing uninitialized pointers. An additional problem is that there is no limit on the maximum possible buffer_size. When there are too many extents, the client may create a layoutcommit that is larger than the maximum possible RPC size accepted by the server. During testing, we observed two typical scenarios. First, one memory page for extents is enough when we work with small files, append data to the end of the file, or preallocate extents before writing. But when we fill a new large file without preallocating, the number of extents can be huge, and counting the number of written extents in ext_tree_encode_commit() does not help much. Since this number increases even more between unlocking and locking of ext_tree, the reallocated buffer may not be large enough again and again.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-908 Use of Uninitialized Resource\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38693\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar commit: commit 0ed554fd769a (\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38694\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar issue occurs when access msg[1].buf[0] and msg[1].buf[1]. Similar commit: commit 0ed554fd769a (\"media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()\")\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38695\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the resultant cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() may occur before sli4_hba.hdwqs are allocated. This may result in a null pointer dereference when attempting to take the abts_io_buf_list_lock for the first hardware queue. Fix by adding a null ptr check on phba->sli4_hba.hdwq and early return because this situation means there must have been an error during port initialization.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38696\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: MIPS: Don't crash in stack_top() for tasks without ABI or vDSO Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL ABI pointer and crash. This can for example happen when using kunit: mips_stack_top+0x28/0xc0 arch_pick_mmap_layout+0x190/0x220 kunit_vm_mmap_init+0xf8/0x138 __kunit_add_resource+0x40/0xa8 kunit_vm_mmap+0x88/0xd8 usercopy_test_init+0xb8/0x240 kunit_try_run_case+0x5c/0x1a8 kunit_generic_run_threadfn_adapter+0x28/0x50 kthread+0x118/0x240 ret_from_kernel_thread+0x14/0x1c Only dereference the ABI point if it is set. The GIC page is also included as it is specific to the vDSO. Also move the randomization adjustment into the same conditional.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38697\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: upper bound check of tree index in dbAllocAG When computing the tree index in dbAllocAG, we never check if we are out of bounds realative to the size of the stree. This could happen in a scenario where the filesystem metadata are corrupted.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38698\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: Regular file corruption check The reproducer builds a corrupted file on disk with a negative i_size value. Add a check when opening this file to avoid subsequent operation failures.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38699\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Double-free fix When the bfad_im_probe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfad->im to NULL. Subsequently, during driver uninstallation, when the state machine enters the bfad_sm_stopping state and calls the bfad_im_probe_undo() function, it attempts to free the memory pointed to by bfad->im again, thereby triggering a double-free vulnerability. Set bfad->im to NULL if probing fails.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-415 Double Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.4\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38700\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated In case of an ib_fast_reg_mr allocation failure during iSER setup, the machine hits a panic because iscsi_conn->dd_data is initialized unconditionally, even when no memory is allocated (dd_size == 0). This leads invalid pointer dereference during connection teardown. Fix by setting iscsi_conn->dd_data only if memory is actually allocated. Panic trace: ------------ iser: iser_create_fastreg_desc: Failed to allocate ib_fast_reg_mr err=-12 iser: iser_alloc_rx_descriptors: failed allocating rx descriptors / data buffers BUG: unable to handle page fault for address: fffffffffffffff8 RIP: 0010:swake_up_locked.part.5+0xa/0x40 Call Trace: complete+0x31/0x40 iscsi_iser_conn_stop+0x88/0xb0 [ib_iser] iscsi_stop_conn+0x66/0xc0 [scsi_transport_iscsi] iscsi_if_stop_conn+0x14a/0x150 [scsi_transport_iscsi] iscsi_if_rx+0x1135/0x1834 [scsi_transport_iscsi] ? netlink_lookup+0x12f/0x1b0 ? netlink_deliver_tap+0x2c/0x200 netlink_unicast+0x1ab/0x280 netlink_sendmsg+0x257/0x4f0 ? _copy_from_user+0x29/0x60 sock_sendmsg+0x5f/0x70\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38701\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missing the system.data extended attribute. Since this can happen due to a maiciouly fuzzed file system, we shouldn't BUG, but rather, report it as a corrupted file system. Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii ext4_create_inline_data() and ext4_inline_data_truncate().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-617 Reachable Assertion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38702\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fbdev: fix potential buffer overflow in do_register_framebuffer() The current implementation may lead to buffer overflow when: 1. Unregistration creates NULL gaps in registered_fb[] 2. All array slots become occupied despite num_registered_fb < FB_MAX 3. The registration loop exceeds array bounds Add boundary check to prevent registered_fb[FB_MAX] access.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38706\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on the system. On module removal the soc_tplg_remove_link() would call snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored, no runtime was created.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38707\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add sanity check for file name The length of the file name should be smaller than the directory entry size.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38708\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD tries to detect \"concurrent\" writes and handle write conflicts, so that even if you write to the same sector simultaneously on both nodes, they end up with the identical data once the writes are completed. In handling \"superseeded\" writes, we forgot a kref_get, resulting in a premature drbd_destroy_device and use after free, and further to kernel crashes with symptoms. Relevance: No one should use DRBD as a random data generator, and apparently all users of \"two-primaries\" handle concurrent writes correctly on layer up. That is cluster file systems use some distributed lock manager, and live migration in virtualization environments stops writes on one node before starting writes on the other node. Which means that other than for \"test cases\", this code path is never taken in real life. FYI, in DRBD 9, things are handled differently nowadays. We still detect \"write conflicts\", but no longer try to be smart about them. We decided to disconnect hard instead: upper layers must not submit concurrent writes. If they do, that's their fault.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38711\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb/server: avoid deadlock when linking with ReplaceIfExists If smb2_create_link() is called with ReplaceIfExists set and the name does exist then a deadlock will happen. ksmbd_vfs_kern_path_locked() will return with success and the parent directory will be locked. ksmbd_vfs_remove_file() will then remove the file. ksmbd_vfs_link() will then be called while the parent is still locked. It will try to lock the same parent and will deadlock. This patch moves the ksmbd_vfs_kern_path_unlock() call to *before* ksmbd_vfs_link() and then simplifies the code, removing the file_present flag variable.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38712\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplus_fill_super() assumes that the attributes file is not yet created, which later results in hitting BUG_ON() when hfsplus_create_attributes_file() is called. Replace this BUG_ON() with -EIO error with a message to suggest running fsck tool.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38713\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc(): [ 667.121659][ T9805] ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][ T9805] [ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0 [ 667.124911][ T9805] print_report+0xd0/0x660 [ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610 [ 667.124928][ T9805] ? __phys_addr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124942][ T9805] kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][ T9805] hfsplus_uni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360 [ 667.124974][ T9805] hfsplus_readdir+0x845/0xfc0 [ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10 [ 667.124994][ T9805] ? stack_trace_save+0x8e/0xc0 [ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125015][ T9805] ? trace_lock_acquire+0x85/0xd0 [ 667.125022][ T9805] ? lock_acquire+0x30/0x80 [ 667.125029][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10 [ 667.125058][ T9805] ? apparmor_file_permission+0x239/0x3e0 [ 667.125069][ T9805] iterate_dir+0x296/0xb20 [ 667.125076][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10 [ 667.125091][ T9805] ? __x64_sys_openat+0x141/0x200 [ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10 [ 667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0 [ 667.125143][ T9805] do_syscall_64+0xc9/0x480 [ 667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] [ 667.125210][ T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasan_save_stack+0x20/0x40 [ 667.146352][ T9805] kasan_save_track+0x14/0x30 [ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0 [ 667.147065][ T9805] __kmalloc_noprof+0x205/0x550 [ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0 [ 667.147813][ T9805] hfsplus_readdir+0x220/0xfc0 [ 667.148174][ T9805] iterate_dir+0x296/0xb20 [ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805] do_syscall_64+0xc9/0x480 [ 667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.1 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38714\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() The hfsplus_bnode_read() method can trigger the issue: [ 174.852007][ T9784] ================================================================== [ 174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360 [ 174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784 [ 174.854059][ T9784] [ 174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full) [ 174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.854286][ T9784] Call Trace: [ 174.854289][ T9784] [ 174.854292][ T9784] dump_stack_lvl+0x10e/0x1f0 [ 174.854305][ T9784] print_report+0xd0/0x660 [ 174.854315][ T9784] ? __virt_addr_valid+0x81/0x610 [ 174.854323][ T9784] ? __phys_addr+0xe8/0x180 [ 174.854330][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854337][ T9784] kasan_report+0xc6/0x100 [ 174.854346][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854354][ T9784] hfsplus_bnode_read+0x2f4/0x360 [ 174.854362][ T9784] hfsplus_bnode_dump+0x2ec/0x380 [ 174.854370][ T9784] ? __pfx_hfsplus_bnode_dump+0x10/0x10 [ 174.854377][ T9784] ? hfsplus_bnode_write_u16+0x83/0xb0 [ 174.854385][ T9784] ? srcu_gp_start+0xd0/0x310 [ 174.854393][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854402][ T9784] hfsplus_brec_remove+0x3d2/0x4e0 [ 174.854411][ T9784] __hfsplus_delete_attr+0x290/0x3a0 [ 174.854419][ T9784] ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10 [ 174.854427][ T9784] ? __pfx___hfsplus_delete_attr+0x10/0x10 [ 174.854436][ T9784] ? __asan_memset+0x23/0x50 [ 174.854450][ T9784] hfsplus_delete_all_attrs+0x262/0x320 [ 174.854459][ T9784] ? __pfx_hfsplus_delete_all_attrs+0x10/0x10 [ 174.854469][ T9784] ? rcu_is_watching+0x12/0xc0 [ 174.854476][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854483][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.854493][ T9784] ? __pfx_hfsplus_delete_cat+0x10/0x10 [ 174.854507][ T9784] hfsplus_unlink+0x1ca/0x7c0 [ 174.854516][ T9784] ? __pfx_hfsplus_unlink+0x10/0x10 [ 174.854525][ T9784] ? down_write+0x148/0x200 [ 174.854532][ T9784] ? __pfx_down_write+0x10/0x10 [ 174.854540][ T9784] vfs_unlink+0x2fe/0x9b0 [ 174.854549][ T9784] do_unlinkat+0x490/0x670 [ 174.854557][ T9784] ? __pfx_do_unlinkat+0x10/0x10 [ 174.854565][ T9784] ? __might_fault+0xbc/0x130 [ 174.854576][ T9784] ? getname_flags.part.0+0x1c5/0x550 [ 174.854584][ T9784] __x64_sys_unlink+0xc5/0x110 [ 174.854592][ T9784] do_syscall_64+0xc9/0x480 [ 174.854600][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167 [ 174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08 [ 174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167 [ 174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50 [ 174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40 [ 174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0 [ 174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 174.854658][ T9784] [ 174.854661][ T9784] [ 174.879281][ T9784] Allocated by task 9784: [ 174.879664][ T9784] kasan_save_stack+0x20/0x40 [ 174.880082][ T9784] kasan_save_track+0x14/0x30 [ 174.880500][ T9784] __kasan_kmalloc+0xaa/0xb0 [ 174.880908][ T9784] __kmalloc_noprof+0x205/0x550 [ 174.881337][ T9784] __hfs_bnode_create+0x107/0x890 [ 174.881779][ T9784] hfsplus_bnode_find+0x2d0/0xd10 [ 174.882222][ T9784] hfsplus_brec_find+0x2b0/0x520 [ 174.882659][ T9784] hfsplus_delete_all_attrs+0x23b/0x3 ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38715\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: hfs: fix slab-out-of-bounds in hfs_bnode_read() This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(), hfs_bnode_copy(), and hfs_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38721\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone. This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0. This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever. This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list. One fix would to change this to: if (res < 0) { if (ct != last) nf_conntrack_get(&ct->ct_general); But this reference counting isn't needed in the first place. We can just store a cookie value instead. A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-772 Missing Release of Resource after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38723\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix jump offset calculation in tailcall The extra pass of bpf_int_jit_compile() skips JIT context initialization which essentially skips offset calculation leaving out_offset = -1, so the jmp_offset in emit_bpf_tail_call is calculated by \"#define jmp_offset (out_offset - (cur_offset))\" is a negative number, which is wrong. The final generated assembly are as follow. 54: bgeu $a2, $t1, -8 # 0x0000004c 58: addi.d $a6, $s5, -1 5c: bltz $a6, -16 # 0x0000004c 60: alsl.d $t2, $a2, $a1, 0x3 64: ld.d $t2, $t2, 264 68: beq $t2, $zero, -28 # 0x0000004c Before apply this patch, the follow test case will reveal soft lock issues. cd tools/testing/selftests/bpf/ ./test_progs --allow=tailcalls/tailcall_bpf2bpf_1 dmesg: watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [test_progs:25056]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38724\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38725\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: add phy_mask for ax88772 mdio bus Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00 ~ 0x1f. DLink DUB-E100 H/W Ver B1 is such a device. However, only one main phy device will bind to net phy driver. This is creating issue during system suspend/resume since phy_polling_mode() in phy_state_machine() will directly deference member of phydev->drv for non-main phy devices. Then NULL pointer dereference issue will occur. Due to only external phy or internal phy is necessary, add phy_mask for ax88772 mdio bus to workarnoud the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38727\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netlink: avoid infinite retry looping in netlink_unicast() netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has: rmem < READ_ONCE(sk->sk_rcvbuf) to check if the just increased rmem value fits into the socket's receive buffer. If not, it proceeds and tries to wait for the memory under: rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf) The checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is equal to sk->sk_rcvbuf. Thus the function neither successfully accepts these conditions, nor manages to reschedule the task - and is called in retry loop for indefinite time which is caught as: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 0-....: (25999 ticks this GP) idle=ef2/1/0x4000000000000000 softirq=262269/262269 fqs=6212 (t=26000 jiffies g=230833 q=259957) NMI backtrace for cpu 0 CPU: 0 PID: 22 Comm: kauditd Not tainted 5.10.240 #68 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc42 04/01/2014 Call Trace: dump_stack lib/dump_stack.c:120 nmi_cpu_backtrace.cold lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace lib/nmi_backtrace.c:62 rcu_dump_cpu_stacks kernel/rcu/tree_stall.h:335 rcu_sched_clock_irq.cold kernel/rcu/tree.c:2590 update_process_times kernel/time/timer.c:1953 tick_sched_handle kernel/time/tick-sched.c:227 tick_sched_timer kernel/time/tick-sched.c:1399 __hrtimer_run_queues kernel/time/hrtimer.c:1652 hrtimer_interrupt kernel/time/hrtimer.c:1717 __sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1113 asm_call_irq_on_stack arch/x86/entry/entry_64.S:808 netlink_attachskb net/netlink/af_netlink.c:1234 netlink_unicast net/netlink/af_netlink.c:1349 kauditd_send_queue kernel/audit.c:776 kauditd_thread kernel/audit.c:897 kthread kernel/kthread.c:328 ret_from_fork arch/x86/entry/entry_64.S:304 Restore the original behavior of the check which commit in Fixes accidentally missed when restructuring the code. Found by Linux Verification Center (linuxtesting.org).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38728\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below): BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827 CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38729\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38732\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject: don't leak dst refcount for loopback packets recent patches to add a WARN() when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 [..] Call Trace: nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] .. This is because blamed commit forgot about loopback packets. Such packets already have a dst_entry attached, even at PRE_ROUTING stage. Instead of checking hook just check if the skb already has a route attached to it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-911 Improper Update of Reference Count\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.8\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38735\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: gve: prevent ethtool ops after shutdown A crash can occur if an ethtool operation is invoked after shutdown() is called. shutdown() is invoked during system shutdown to stop DMA operations without performing expensive deallocations. It is discouraged to unregister the netdev in this path, so the device may still be visible to userspace and kernel helpers. In gve, shutdown() tears down most internal data structures. If an ethtool operation is dispatched after shutdown(), it will dereference freed or NULL pointers, leading to a kernel panic. While graceful shutdown normally quiesces userspace before invoking the reboot syscall, forced shutdowns (as observed on GCP VMs) can still trigger this path. Fix by calling netif_device_detach() in shutdown(). This marks the device as detached so the ethtool ioctl handler will skip dispatching operations to the driver.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-664 Improper Control of a Resource Through its Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-38736\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization Syzbot reported shift-out-of-bounds exception on MDIO bus initialization. The PHY address should be masked to 5 bits (0-31). Without this mask, invalid PHY addresses could be used, potentially causing issues with MDIO bus operations. Fix this by masking the PHY address with 0x1f (31 decimal) to ensure it stays within the valid range.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39673\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic. 2. pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels. Fix these by using a lockless RCU approach: - Use list_first_or_null_rcu() to safely test and access the first list entry. - Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal. - Check for a NULL pch->chan before dereferencing it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39675\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() The function mod_hdcp_hdcp1_create_session() calls the function get_first_active_display(), but does not check its return value. The return value is a null pointer if the display list is empty. This will lead to a null pointer dereference. Add a null pointer check for get_first_active_display() and return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND if the function return null. This is similar to the commit c3e9826a2202 (\"drm/amd/display: Add null pointer check for get_first_active_display()\"). (cherry picked from commit 5e43eb3cd731649c4f8b9134f857be62a416c893)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39676\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Prevent a potential error pointer dereference The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-394 Unexpected Status Code or Return Value\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.1\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39681\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd (\"x86/resctrl: Query LLC monitoring properties once during boot\") resctrl_cpu_detect() has been moved from common CPU initialization code to the vendor-specific BSP init helper, while Hygon didn't put that call in their code. This triggers a division by zero fault during early booting stage on our machines with X86_FEATURE_CQM* supported, where get_rdt_mon_resources() tries to calculate mon_l3_config with uninitialized boot_cpu_data.x86_cache_occ_scale. Add the missing resctrl_cpu_detect() in the Hygon BSP init helper. [ bp: Massage commit message. ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-369 Divide By Zero\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39682\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39683\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tracing: Limit access to parser->buffer when trace_get_user failed When the length of the string written to set_ftrace_filter exceeds FTRACE_BUFF_MAX, the following KASAN alarm will be triggered: BUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0 Read of size 1 at addr ffff0000d00bd5ba by task ash/165 CPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x34/0x50 (C) dump_stack_lvl+0xa0/0x158 print_address_description.constprop.0+0x88/0x398 print_report+0xb0/0x280 kasan_report+0xa4/0xf0 __asan_report_load1_noabort+0x20/0x30 strsep+0x18c/0x1b0 ftrace_process_regex.isra.0+0x100/0x2d8 ftrace_regex_release+0x484/0x618 __fput+0x364/0xa58 ____fput+0x28/0x40 task_work_run+0x154/0x278 do_notify_resume+0x1f0/0x220 el0_svc+0xec/0xf0 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1ac/0x1b0 The reason is that trace_get_user will fail when processing a string longer than FTRACE_BUFF_MAX, but not set the end of parser->buffer to 0. Then an OOB access will be triggered in ftrace_regex_release-> ftrace_process_regex->strsep->strpbrk. We can solve this problem by limiting access to parser->buffer when trace_get_user failed.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39684\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() syzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`. A kernel buffer is allocated to hold `insn->n` samples (each of which is an `unsigned int`). For some instruction types, `insn->n` samples are copied back to user-space, unless an error code is being returned. The problem is that not all the instruction handlers that need to return data to userspace fill in the whole `insn->n` samples, so that there is an information leak. There is a similar syzbot report for `do_insnlist_ioctl()`, although it does not have a reproducer for it at the time of writing. One culprit is `insn_rw_emulate_bits()` which is used as the handler for `INSN_READ` or `INSN_WRITE` instructions for subdevices that do not have a specific handler for that instruction, but do have an `INSN_BITS` handler. For `INSN_READ` it only fills in at most 1 sample, so if `insn->n` is greater than 1, the remaining `insn->n - 1` samples copied to userspace will be uninitialized kernel data. Another culprit is `vm80xx_ai_insn_read()` in the \"vm80xx\" driver. It never returns an error, even if it fails to fill the buffer. Fix it in `do_insn_ioctl()` and `do_insnlist_ioctl()` by making sure that uninitialized parts of the allocated buffer are zeroed before handling each instruction. Thanks to Arnaud Lecomte for their fix to `do_insn_ioctl()`. That fix replaced the call to `kmalloc_array()` with `kcalloc()`, but it is not always necessary to clear the whole buffer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39685\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: pcl726: Prevent invalid irq number The reproducer passed in an irq number(0x80008000) that was too large, which triggered the oob. Added an interrupt number check to prevent users from passing in an irq number that was too large. If `it->options[1]` is 31, then `1 << it->options[1]` is still invalid because it shifts a 1-bit into the sign bit (which is UB in C). Possible solutions include reducing the upper bound on the `it->options[1]` value to 30 or lower, or using `1U << it->options[1]`. The old code would just not attempt to request the IRQ if the `options[1]` value were invalid. And it would still configure the device without interrupts even if the call to `request_irq` returned an error. So it would be better to combine this test with the test below.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39686\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: comedi: Make insn_rw_emulate_bits() do insn->n samples The `insn_rw_emulate_bits()` function is used as a default handler for `INSN_READ` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_READ`. Similarly, it is used as a default handler for `INSN_WRITE` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_WRITE`. It works by emulating the `INSN_READ` or `INSN_WRITE` instruction handling with a constructed `INSN_BITS` instruction. However, `INSN_READ` and `INSN_WRITE` instructions are supposed to be able read or write multiple samples, indicated by the `insn->n` value, but `insn_rw_emulate_bits()` currently only handles a single sample. For `INSN_READ`, the comedi core will copy `insn->n` samples back to user-space. (That triggered KASAN kernel-infoleak errors when `insn->n` was greater than 1, but that is being fixed more generally elsewhere in the comedi core.) Make `insn_rw_emulate_bits()` either handle `insn->n` samples, or return an error, to conform to the general expectation for `INSN_READ` and `INSN_WRITE` handlers.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39687\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: light: as73211: Ensure buffer holes are zeroed Given that the buffer is copied to a kfifo that ultimately user space can read, ensure we zero it.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39689\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the reader keeps the pointer to the filter hashes. This is problematic because this pointer is static across function calls that release the locks that can update the global tracer hashes. This can cause UAF and similar bugs. Allocate and copy the hash for reading the filter files like it is done for the writers. This not only fixes UAF bugs, but also makes the code a bit simpler as it doesn't have to differentiate when to free the iterator's hash between writers and readers.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39691\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.16.0-862.14.0.6.x86_64 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: dump_stack_lvl+0x55/0x70 print_address_description.constprop.0+0x2c/0x390 print_report+0xb4/0x270 kasan_report+0xb8/0xf0 end_buffer_read_sync+0xe3/0x110 end_bio_bh_io_sync+0x56/0x80 blk_update_request+0x30a/0x720 scsi_end_request+0x51/0x2b0 scsi_io_completion+0xe3/0x480 ? scsi_device_unbusy+0x11e/0x160 blk_complete_reqs+0x7b/0x90 handle_softirqs+0xef/0x370 irq_exit_rcu+0xa5/0xd0 sysvec_apic_timer_interrupt+0x6e/0x90 Above issue happens when do ntfs3 filesystem mount, issue may happens as follows: mount IRQ ntfs_fill_super read_cache_page do_read_cache_folio filemap_read_folio mpage_read_folio do_mpage_readpage ntfs_get_block_vbo bh_read submit_bh wait_on_buffer(bh); blk_complete_reqs scsi_io_completion scsi_end_request blk_update_request end_bio_bh_io_sync end_buffer_read_sync __end_buffer_read_notouch unlock_buffer wait_on_buffer(bh);--> return will return to caller put_bh --> trigger stack-out-of-bounds In the mpage_read_folio() function, the stack variable 'map_bh' is passed to ntfs_get_block_vbo(). Once unlock_buffer() unlocks and wait_on_buffer() returns to continue processing, the stack variable is likely to be reclaimed. Consequently, during the end_buffer_read_sync() process, calling put_bh() may result in stack overrun. If the bh is not allocated on the stack, it belongs to a folio. Freeing a buffer head which belongs to a folio is done by drop_buffers() which will fail to free buffers which are still locked. So it is safe to call put_bh() before __end_buffer_read_notouch().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.4\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39692\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() We can't call destroy_workqueue(smb_direct_wq); before stop_sessions()! Otherwise already existing connections try to use smb_direct_wq as a NULL pointer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39693\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid a NULL pointer dereference [WHY] Although unlikely drm_atomic_get_new_connector_state() or drm_atomic_get_old_connector_state() can return NULL. [HOW] Check returns before dereference. (cherry picked from commit 1e5e8d672fec9f2ab352be121be971877bff2af9)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39694\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrupt is NULL. This check is performed after physical to virtual address translation. If the kernel identity mapping does not start at address zero, the resulting virtual address is never zero, so that the NULL checks won't work. Subsequently this may result in incorrect accesses to the first page of the identity mapping. Fix this by introducing a function that handles the NULL case before address translation.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1285 Improper Validation of Specified Index, Position, or Offset in Input\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39697\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_request() from succeeding until we actually lock the page group. The reason is that whoever called nfs_inode_remove_request() doesn't necessarily have a lock on the page group head. So in order to avoid races, let's take the page group lock earlier in nfs_lock_and_join_requests(), and hold it across the removal of the request in nfs_inode_remove_request().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.7\nMEDIUM\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39701\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: Fix the driver update version check The security-version-number check should be used rather than the runtime version check for driver updates. Otherwise, the firmware update would fail when the update binary had a lower runtime version number than the current one. [ rjw: Changelog edits ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1025 Comparison Using Wrong Factors\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39702\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-208 Observable Timing Discrepancy\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39703\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net, hsr: reject HSR frame if skb can't hold tag Receiving HSR frame with insufficient space to hold HSR tag in the skb can result in a crash (kernel BUG): [ 45.390915] skbuff: skb_under_panic: text:ffffffff86f32cac len:26 put:14 head:ffff888042418000 data:ffff888042417ff4 tail:0xe end:0x180 dev:bridge_slave_1 [ 45.392559] ------------[ cut here ]------------ [ 45.392912] kernel BUG at net/core/skbuff.c:211! [ 45.393276] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 45.393809] CPU: 1 UID: 0 PID: 2496 Comm: reproducer Not tainted 6.15.0 #12 PREEMPT(undef) [ 45.394433] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 45.395273] RIP: 0010:skb_panic+0x15b/0x1d0 [ 45.402911] Call Trace: [ 45.403105] [ 45.404470] skb_push+0xcd/0xf0 [ 45.404726] br_dev_queue_push_xmit+0x7c/0x6c0 [ 45.406513] br_forward_finish+0x128/0x260 [ 45.408483] __br_forward+0x42d/0x590 [ 45.409464] maybe_deliver+0x2eb/0x420 [ 45.409763] br_flood+0x174/0x4a0 [ 45.410030] br_handle_frame_finish+0xc7c/0x1bc0 [ 45.411618] br_handle_frame+0xac3/0x1230 [ 45.413674] __netif_receive_skb_core.constprop.0+0x808/0x3df0 [ 45.422966] __netif_receive_skb_one_core+0xb4/0x1f0 [ 45.424478] __netif_receive_skb+0x22/0x170 [ 45.424806] process_backlog+0x242/0x6d0 [ 45.425116] __napi_poll+0xbb/0x630 [ 45.425394] net_rx_action+0x4d1/0xcc0 [ 45.427613] handle_softirqs+0x1a4/0x580 [ 45.427926] do_softirq+0x74/0x90 [ 45.428196] This issue was found by syzkaller. The panic happens in br_dev_queue_push_xmit() once it receives a corrupted skb with ETH header already pushed in linear data. When it attempts the skb_push() call, there's not enough headroom and skb_push() panics. The corrupted skb is put on the queue by HSR layer, which makes a sequence of unintended transformations when it receives a specific corrupted HSR frame (with incomplete TAG). Fix it by dropping and consuming frames that are not long enough to contain both ethernet and hsr headers. Alternative fix would be to check for enough headroom before skb_push() in br_dev_queue_push_xmit(). In the reproducer, this is injected via AF_PACKET, but I don't easily see why it couldn't be sent over the wire from adjacent network. Further Details: In the reproducer, the following network interface chain is set up: \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 veth0_to_hsr \u251c\u2500\u2500\u2500\u2524 hsr_slave0 \u253c\u2500\u2500\u2500\u2510 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u251c\u2500\u2524 hsr0 \u251c\u2500\u2500\u2500\u2510 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 \u2502\u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 veth1_to_hsr \u253c\u2500\u2500\u2500\u2524 hsr_slave1 \u251c\u2500\u2500\u2500\u2518 \u2514\u2524 \u2502 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u250c\u253c bridge \u2502 \u2502\u2502 \u2502 \u2502\u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2502 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510 \u2502 \u2502 ... \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2518 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518 To trigger the events leading up to crash, reproducer sends a corrupted HSR fr ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-1286 Improper Validation of Syntactic Correctness of Input\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39706\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Destroy KFD debugfs after destroy KFD wq Since KFD proc content was moved to kernel debugfs, we can't destroy KFD debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line debugfs_remove_recursive(entry->proc_dentry); tries to remove /sys/kernel/debug/kfd/proc/ while /sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel NULL pointer. (cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39709\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: protect against spurious interrupts during probe Make sure the interrupt handler is initialized before the interrupt is registered. If the IRQ is registered before hfi_create(), it's possible that an interrupt fires before the handler setup is complete, leading to a NULL dereference. This error condition has been observed during system boot on Rb3Gen2.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39710\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: venus: Add a check for packet size after reading from shared memory Add a check to ensure that the packet size does not exceed the number of available words after reading the packet header from shared memory. This ensures that the size provided by the firmware is safe to process and prevent potential out-of-bounds memory access.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39713\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() In the interrupt handler rain_interrupt(), the buffer full check on rain->buf_len is performed before acquiring rain->buf_lock. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as rain->buf_len is concurrently accessed and modified in the work handler rain_irq_work_handler() under the same lock. Multiple interrupt invocations can race, with each reading buf_len before it becomes full and then proceeding. This can lead to both interrupts attempting to write to the buffer, incrementing buf_len beyond its capacity (DATA_SIZE) and causing a buffer overflow. Fix this bug by moving the spin_lock() to before the buffer full check. This ensures that the check and the subsequent buffer modification are performed atomically, preventing the race condition. An corresponding spin_unlock() is added to the overflow path to correctly release the lock. This possible bug was found by an experimental static analysis tool developed by our team.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39714\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: media: usbtv: Lock resolution while streaming When an program is streaming (ffplay) and another program (qv4l2) changes the TV standard from NTSC to PAL, the kernel crashes due to trying to copy to unmapped memory. Changing from NTSC to PAL increases the resolution in the usbtv struct, but the video plane buffer isn't adjusted, so it overflows. [hverkuil: call vb2_is_busy instead of vb2_is_streaming]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39715\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: parisc: Revise gateway LWS calls to probe user read access We use load and stbys,e instructions to trigger memory reference interruptions without writing to memory. Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel and gateway page execute at privilege level 0, so this code never triggers a read access interruption. Thus, it is currently possible for user code to execute a LWS compare and swap operation at an address that is read protected at privilege level 3 (PRIV_USER). Fix this by probing read access rights at privilege level 3 and branching to lws_fault if access isn't allowed.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39716\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: parisc: Revise __get_user() to probe user read access Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel executes at privilege level 0, so __get_user() never triggers a read access interruption (code 26). Thus, it is currently possible for user code to access a read protected address via a system call. Fix this by probing read access rights at privilege level 3 (PRIV_USER) and setting __gu_err to -EFAULT (-14) if access isn't allowed. Note the cmpiclr instruction does a 32-bit compare because COND macro doesn't work inside asm.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39718\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately, virtio_vsock_skb_rx_put() uses the length from the packet header as the length argument to skb_put(), potentially resulting in SKB overflow if the host has gone wonky. Validate the length as advertised by the packet header before calling virtio_vsock_skb_rx_put().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.6\nHIGH\nCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39719\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: iio: imu: bno055: fix OOB access of hw_xlate array Fix a potential out-of-bounds array access of the hw_xlate array in bno055.c. In bno055_get_regmask(), hw_xlate was iterated over the length of the vals array instead of the length of the hw_xlate array. In the case of bno055_gyr_scale, the vals array is larger than the hw_xlate array, so this could result in an out-of-bounds access. In practice, this shouldn't happen though because a match should always be found which breaks out of the for loop before it iterates beyond the end of the hw_xlate array. By adding a new hw_xlate_len field to the bno055_sysfs_attr, we can be sure we are iterating over the correct length.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39724\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix panic due to PSLVERR When the PSLVERR_RESP_EN parameter is set to 1, the device generates an error response if an attempt is made to read an empty RBR (Receive Buffer Register) while the FIFO is enabled. In serial8250_do_startup(), calling serial_port_out(port, UART_LCR, UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes dw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter function enables the FIFO via serial_out(p, UART_FCR, p->fcr). Execution proceeds to the serial_port_in(port, UART_RX). This satisfies the PSLVERR trigger condition. When another CPU (e.g., using printk()) is accessing the UART (UART is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter dw8250_force_idle(). Put serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock to fix this issue. Panic backtrace: [ 0.442336] Oops - unknown exception [#1] [ 0.442343] epc : dw8250_serial_in32+0x1e/0x4a [ 0.442351] ra : serial8250_do_startup+0x2c8/0x88e ... [ 0.442416] console_on_rootfs+0x26/0x70\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39736\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() can cause a deadlock due to lock inversion with the netconsole subsystem. This occurs because pr_warn_once() may trigger netpoll, which eventually leads to __alloc_skb() and back into kmemleak code, attempting to reacquire kmemleak_lock. This is the path for the deadlock. mem_pool_alloc() -> raw_spin_lock_irqsave(&kmemleak_lock, flags); -> pr_warn_once() -> netconsole subsystem -> netpoll -> __alloc_skb -> __create_object -> raw_spin_lock_irqsave(&kmemleak_lock, flags); Fix this by setting a flag and issuing the pr_warn_once() after kmemleak_lock is released.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-833 Deadlock\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39737\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() A soft lockup warning was observed on a relative small system x86-64 system with 16 GB of memory when running a debug kernel with kmemleak enabled. watchdog: BUG: soft lockup - CPU#8 stuck for 33s! [kworker/8:1:134] The test system was running a workload with hot unplug happening in parallel. Then kemleak decided to disable itself due to its inability to allocate more kmemleak objects. The debug kernel has its CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE set to 40,000. The soft lockup happened in kmemleak_do_cleanup() when the existing kmemleak objects were being removed and deleted one-by-one in a loop via a workqueue. In this particular case, there are at least 40,000 objects that need to be processed and given the slowness of a debug kernel and the fact that a raw_spinlock has to be acquired and released in __delete_object(), it could take a while to properly handle all these objects. As kmemleak has been disabled in this case, the object removal and deletion process can be further optimized as locking isn't really needed. However, it is probably not worth the effort to optimize for such an edge case that should rarely happen. So the simple solution is to call cond_resched() at periodic interval in the iteration loop to avoid soft lockup.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39738\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: do not allow relocation of partially dropped subvolumes [BUG] There is an internal report that balance triggered transaction abort, with the following call trace: item 85 key (594509824 169 0) itemoff 12599 itemsize 33 extent refs 1 gen 197740 flags 2 ref#0: tree block backref root 7 item 86 key (594558976 169 0) itemoff 12566 itemsize 33 extent refs 1 gen 197522 flags 2 ref#0: tree block backref root 7 ... BTRFS error (device loop0): extent item not found for insert, bytenr 594526208 num_bytes 16384 parent 449921024 root_objectid 934 owner 1 offset 0 BTRFS error (device loop0): failed to run delayed ref for logical 594526208 num_bytes 16384 type 182 action 1 ref_mod 1: -117 ------------[ cut here ]------------ BTRFS: Transaction aborted (error -117) WARNING: CPU: 1 PID: 6963 at ../fs/btrfs/extent-tree.c:2168 btrfs_run_delayed_refs+0xfa/0x110 [btrfs] And btrfs check doesn't report anything wrong related to the extent tree. [CAUSE] The cause is a little complex, firstly the extent tree indeed doesn't have the backref for 594526208. The extent tree only have the following two backrefs around that bytenr on-disk: item 65 key (594509824 METADATA_ITEM 0) itemoff 13880 itemsize 33 refs 1 gen 197740 flags TREE_BLOCK tree block skinny level 0 (176 0x7) tree block backref root CSUM_TREE item 66 key (594558976 METADATA_ITEM 0) itemoff 13847 itemsize 33 refs 1 gen 197522 flags TREE_BLOCK tree block skinny level 0 (176 0x7) tree block backref root CSUM_TREE But the such missing backref item is not an corruption on disk, as the offending delayed ref belongs to subvolume 934, and that subvolume is being dropped: item 0 key (934 ROOT_ITEM 198229) itemoff 15844 itemsize 439 generation 198229 root_dirid 256 bytenr 10741039104 byte_limit 0 bytes_used 345571328 last_snapshot 198229 flags 0x1000000000001(RDONLY) refs 0 drop_progress key (206324 EXTENT_DATA 2711650304) drop_level 2 level 2 generation_v2 198229 And that offending tree block 594526208 is inside the dropped range of that subvolume. That explains why there is no backref item for that bytenr and why btrfs check is not reporting anything wrong. But this also shows another problem, as btrfs will do all the orphan subvolume cleanup at a read-write mount. So half-dropped subvolume should not exist after an RW mount, and balance itself is also exclusive to subvolume cleanup, meaning we shouldn't hit a subvolume half-dropped during relocation. The root cause is, there is no orphan item for this subvolume. In fact there are 5 subvolumes from around 2021 that have the same problem. It looks like the original report has some older kernels running, and caused those zombie subvolumes. Thankfully upstream commit 8d488a8c7ba2 (\"btrfs: fix subvolume/snapshot deletion not triggered on mount\") has long fixed the bug. [ENHANCEMENT] For repairing such old fs, btrfs-progs will be enhanced. Considering how delayed the problem will show up (at run delayed ref time) and at that time we have to abort transaction already, it is too late. Instead here we reject any half-dropped subvolume for reloc tree at the earliest time, preventing confusion and extra time wasted on debugging similar bugs.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39742\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() The function divides number of online CPUs by num_core_siblings, and later checks the divider by zero. This implies a possibility to get and divide-by-zero runtime error. Fix it by moving the check prior to division. This also helps to save one indentation level.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-369 Divide By Zero\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39743\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jfs: truncate good inode pages when hard link is 0 The fileset value of the inode copy from the disk by the reproducer is AGGR_RESERVED_I. When executing evict, its hard link number is 0, so its inode pages are not truncated. This causes the bugon to be triggered when executing clear_inode() because nrpages is greater than 0.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39749\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: rcu: Protect ->defer_qs_iw_pending from data race On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke rcu_read_unlock_special(), which uses an irq-work handler to force the system to notice when the RCU read-side critical section actually ends. That end won't happen until interrupts are enabled at the soonest. In some kernels, such as those booted with rcutree.use_softirq=y, the irq-work handler is used unconditionally. The per-CPU rcu_data structure's ->defer_qs_iw_pending field is updated by the irq-work handler and is both read and updated by rcu_read_unlock_special(). This resulted in the following KCSAN splat: ------------------------------------------------------------------------ BUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special read to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8: rcu_read_unlock_special+0x175/0x260 __rcu_read_unlock+0x92/0xa0 rt_spin_unlock+0x9b/0xc0 __local_bh_enable+0x10d/0x170 __local_bh_enable_ip+0xfb/0x150 rcu_do_batch+0x595/0xc40 rcu_cpu_kthread+0x4e9/0x830 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 write to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8: rcu_preempt_deferred_qs_handler+0x1e/0x30 irq_work_single+0xaf/0x160 run_irq_workd+0x91/0xc0 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 no locks held by irq_work/8/88. irq event stamp: 200272 hardirqs last enabled at (200272): [] finish_task_switch+0x131/0x320 hardirqs last disabled at (200271): [] __schedule+0x129/0xd70 softirqs last enabled at (0): [] copy_process+0x4df/0x1cc0 softirqs last disabled at (0): [<0000000000000000>] 0x0 ------------------------------------------------------------------------ The problem is that irq-work handlers run with interrupts enabled, which means that rcu_preempt_deferred_qs_handler() could be interrupted, and that interrupt handler might contain an RCU read-side critical section, which might invoke rcu_read_unlock_special(). In the strict KCSAN mode of operation used by RCU, this constitutes a data race on the ->defer_qs_iw_pending field. This commit therefore disables interrupts across the portion of the rcu_preempt_deferred_qs_handler() that updates the ->defer_qs_iw_pending field. This suffices because this handler is not a fast path.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39752\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ARM: rockchip: fix kernel hang during smp initialization In order to bring up secondary CPUs main CPU write trampoline code to SRAM. The trampoline code is written while secondary CPUs are powered on (at least that true for RK3188 CPU). Sometimes that leads to kernel hang. Probably because secondary CPU execute trampoline code while kernel doesn't expect. The patch moves SRAM initialization step to the point where all secondary CPUs are powered down. That fixes rarely hangs on RK3188: [ 0.091568] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.091996] rockchip_smp_prepare_cpus: ncores 4\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-364 Signal Handler Race Condition\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39756\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c: WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288 This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN. Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate: - File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes - Multiple bitmaps: ~400MB - Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647) Reproducer: 1. Set /proc/sys/fs/nr_open to 1073741816: # echo 1073741816 > /proc/sys/fs/nr_open 2. Run a program that uses a high file descriptor: #include #include int main() { struct rlimit rlim = {1073741824, 1073741824}; setrlimit(RLIMIT_NOFILE, &rlim); dup2(2, 1073741880); // Triggers the warning return 0; } 3. Observe WARNING in dmesg at mm/slub.c:5027 systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that: 1. The kernel's allocation functions still enforce INT_MAX as a maximum size regardless of memcg accounting 2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations 3. The resulting allocations (>8GB) are impractical and will always fail systemd's algorithm starts with INT_MAX and keeps halving the value until the kernel accepts it. On most systems, this results in nr_open being set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors. While processes rarely use file descriptors near this limit in normal operation, certain selftests (like tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue. Fix this by adding a check in alloc_fdtable() to ensure the requested allocation size does not exceed INT_MAX. This causes the operation to fail with -EMFILE instead of triggering a kernel warning and avoids the impractical >8GB memory allocation request.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-401 Missing Release of Memory after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39757\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39759\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix race between quota disable and quota rescan ioctl There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fs_info->qgroup_tree rbtree. This happens as follows: 1) Task A enters btrfs_ioctl_quota_rescan() -> btrfs_qgroup_rescan(); 2) Task B enters btrfs_quota_disable() and calls btrfs_qgroup_wait_for_completion(), which does nothing because at that point fs_info->qgroup_rescan_running is false (it wasn't set yet by task A); 3) Task B calls btrfs_free_qgroup_config() which starts freeing qgroups from fs_info->qgroup_tree without taking the lock fs_info->qgroup_lock; 4) Task A enters qgroup_rescan_zero_tracking() which starts iterating the fs_info->qgroup_tree tree while holding fs_info->qgroup_lock, but task B is freeing qgroup records from that tree without holding the lock, resulting in a use-after-free. Fix this by taking fs_info->qgroup_lock at btrfs_free_qgroup_config(). Also at btrfs_qgroup_rescan() don't start the rescan worker if quotas were already disabled.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39760\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this up by checking the size first before looking at any of the fields in the descriptor.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39766\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \\ htb rate 64bit tc qdisc add dev lo parent 1:1 handle f: \\ cake memlimit 1b ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 This is because the low memlimit leads to a low buffer_limit, which causes packet dropping. However, cake_enqueue still returns NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an empty child qdisc. We should return NET_XMIT_CN when packets are dropped from the same tin and flow. I do not believe return value of NET_XMIT_CN is necessary for packet drops in the case of ack filtering, as that is meant to optimize performance, not to signal congestion.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39770\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM When performing Generic Segmentation Offload (GSO) on an IPv6 packet that contains extension headers, the kernel incorrectly requests checksum offload if the egress device only advertises NETIF_F_IPV6_CSUM feature, which has a strict contract: it supports checksum offload only for plain TCP or UDP over IPv6 and explicitly does not support packets with extension headers. The current GSO logic violates this contract by failing to disable the feature for packets with extension headers, such as those used in GREoIPv6 tunnels. This violation results in the device being asked to perform an operation it cannot support, leading to a `skb_warn_bad_offload` warning and a collapse of network throughput. While device TSO/USO is correctly bypassed in favor of software GSO for these packets, the GSO stack must be explicitly told not to request checksum offload. Mask NETIF_F_IPV6_CSUM, NETIF_F_TSO6 and NETIF_F_GSO_UDP_L4 in gso_features_check if the IPv6 header contains extension headers to compute checksum in software. The exception is a BIG TCP extension, which, as stated in commit 68e068cabd2c6c53 (\"net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets\"): \"The feature is only enabled on devices that support BIG TCP TSO. The header is only present for PF_PACKET taps like tcpdump, and not transmitted by physical devices.\" kernel log output (truncated): WARNING: CPU: 1 PID: 5273 at net/core/dev.c:3535 skb_warn_bad_offload+0x81/0x140 ... Call Trace: skb_checksum_help+0x12a/0x1f0 validate_xmit_skb+0x1a3/0x2d0 validate_xmit_skb_list+0x4f/0x80 sch_direct_xmit+0x1a2/0x380 __dev_xmit_skb+0x242/0x670 __dev_queue_xmit+0x3fc/0x7f0 ip6_finish_output2+0x25e/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_tnl_xmit+0x608/0xc00 [ip6_tunnel] ip6gre_tunnel_xmit+0x1c0/0x390 [ip6_gre] dev_hard_start_xmit+0x63/0x1c0 __dev_queue_xmit+0x6d0/0x7f0 ip6_finish_output2+0x214/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 inet6_csk_xmit+0xeb/0x150 __tcp_transmit_skb+0x555/0xa80 tcp_write_xmit+0x32a/0xe90 tcp_sendmsg_locked+0x437/0x1110 tcp_sendmsg+0x2f/0x50 ... skb linear: 00000000: e4 3d 1a 7d ec 30 e4 3d 1a 7e 5d 90 86 dd 60 0e skb linear: 00000010: 00 0a 1b 34 3c 40 20 11 00 00 00 00 00 00 00 00 skb linear: 00000020: 00 00 00 00 00 12 20 11 00 00 00 00 00 00 00 00 skb linear: 00000030: 00 00 00 00 00 11 2f 00 04 01 04 01 01 00 00 00 skb linear: 00000040: 86 dd 60 0e 00 0a 1b 00 06 40 20 23 00 00 00 00 skb linear: 00000050: 00 00 00 00 00 00 00 00 00 12 20 23 00 00 00 00 skb linear: 00000060: 00 00 00 00 00 00 00 00 00 11 bf 96 14 51 13 f9 skb linear: 00000070: ae 27 a0 a8 2b e3 80 18 00 40 5b 6f 00 00 01 01 skb linear: 00000080: 08 0a 42 d4 50 d5 4b 70 f8 1a\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-573 Improper Following of Specification by Caller\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39772\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: drm/hisilicon/hibmc: fix the hibmc loaded failed bug When hibmc loaded failed, the driver use hibmc_unload to free the resource, but the mutexes in mode.config are not init, which will access an NULL pointer. Just change goto statement to return, because hibnc_hw_init() doesn't need to free anything.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39773\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: bridge: fix soft lockup in br_multicast_query_expired() When set multicast_query_interval to a large value, the local variable 'time' in br_multicast_send_query() may overflow. If the time is smaller than jiffies, the timer will expire immediately, and then call mod_timer() again, which creates a loop and may trigger the following soft lockup issue. watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rb_consumer:66] CPU: 1 UID: 0 PID: 66 Comm: rb_consumer Not tainted 6.16.0+ #259 PREEMPT(none) Call Trace: __netdev_alloc_skb+0x2e/0x3a0 br_ip6_multicast_alloc_query+0x212/0x1b70 __br_multicast_send_query+0x376/0xac0 br_multicast_send_query+0x299/0x510 br_multicast_query_expired.constprop.0+0x16d/0x1b0 call_timer_fn+0x3b/0x2a0 __run_timers+0x619/0x950 run_timer_softirq+0x11c/0x220 handle_softirqs+0x18e/0x560 __irq_exit_rcu+0x158/0x1a0 sysvec_apic_timer_interrupt+0x76/0x90 This issue can be reproduced with: ip link add br0 type bridge echo 1 > /sys/class/net/br0/bridge/multicast_querier echo 0xffffffffffffffff > /sys/class/net/br0/bridge/multicast_query_interval ip link set dev br0 up The multicast_startup_query_interval can also cause this issue. Similar to the commit 99b40610956a (\"net: bridge: mcast: add and enforce query interval minimum\"), add check for the query interval maximum to fix this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-667 Improper Locking\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39776\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm/debug_vm_pgtable: clear page table entries at destroy_args() The mm/debug_vm_pagetable test allocates manually page table entries for the tests it runs, using also its manually allocated mm_struct. That in itself is ok, but when it exits, at destroy_args() it fails to clear those entries with the *_clear functions. The problem is that leaves stale entries. If another process allocates an mm_struct with a pgd at the same address, it may end up running into the stale entry. This is happening in practice on a debug kernel with CONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra debugging I added (it prints a warning trace if pgtables_bytes goes negative, in addition to the warning at check_mm() function): [ 2.539353] debug_vm_pgtable: [get_random_vaddr ]: random_vaddr is 0x7ea247140000 [ 2.539366] kmem_cache info [ 2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508 [ 2.539447] debug_vm_pgtable: [init_args ]: args->mm is 0x000000002267cc9e (...) [ 2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0 [ 2.552816] Modules linked in: [ 2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY [ 2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries [ 2.552872] NIP: c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90 [ 2.552885] REGS: c0000000622e73b0 TRAP: 0700 Not tainted (6.12.0-105.debug_vm2.el10.ppc64le+debug) [ 2.552899] MSR: 800000000282b033 CR: 24002822 XER: 0000000a [ 2.552954] CFAR: c0000000008f03f0 IRQMASK: 0 [ 2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001 [ 2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff [ 2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000 [ 2.552954] GPR12: 00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb [ 2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0 [ 2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000 [ 2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001 [ 2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760 [ 2.553170] NIP [c0000000007eef3c] free_pud_range+0x8bc/0x8d0 [ 2.553185] LR [c0000000007eef30] free_pud_range+0x8b0/0x8d0 [ 2.553199] Call Trace: [ 2.553207] [c0000000622e7650] [c0000000007eef30] free_pud_range+0x8b0/0x8d0 (unreliable) [ 2.553229] [c0000000622e7750] [c0000000007f40b4] free_pgd_range+0x284/0x3b0 [ 2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables+0x450/0x570 [ 2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap+0x250/0x650 [ 2.553292] [c0000000622e7a30] [c0000000001b95b8] __mmput+0x98/0x290 [ 2.558344] [c0000000622e7a80] [c0000000001d1018] exit_mm+0x118/0x1b0 [ 2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit+0x2ec/0x870 [ 2.558376] [c0000000622e7b60] [c0000000001d1ca8] do_group_exit+0x88/0x150 [ 2.558391] [c0000000622e7bb0] [c0000000001d1db8] sys_exit_group+0x48/0x50 [ 2.558407] [c0000000622e7be0] [c00000000003d810] system_call_exception+0x1e0/0x4c0 [ 2.558423] [c0000000622e7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec (...) [ 2.558892] ---[ end trace 0000000000000000 ]--- [ 2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1 [ 2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144 Here the modprobe process ended up with an allocated mm_struct from the mm_struct slab that was used before by the debug_vm_pgtable test. That is not a problem, since the mm_stru ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39782\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: jbd2: prevent softlockup in jbd2_log_do_checkpoint() Both jbd2_log_do_checkpoint() and jbd2_journal_shrink_checkpoint_list() periodically release j_list_lock after processing a batch of buffers to avoid long hold times on the j_list_lock. However, since both functions contend for j_list_lock, the combined time spent waiting and processing can be significant. jbd2_journal_shrink_checkpoint_list() explicitly calls cond_resched() when need_resched() is true to avoid softlockups during prolonged operations. But jbd2_log_do_checkpoint() only exits its loop when need_resched() is true, relying on potentially sleeping functions like __flush_batch() or wait_on_buffer() to trigger rescheduling. If those functions do not sleep, the kernel may hit a softlockup. watchdog: BUG: soft lockup - CPU#3 stuck for 156s! [kworker/u129:2:373] CPU: 3 PID: 373 Comm: kworker/u129:2 Kdump: loaded Not tainted 6.6.0+ #10 Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.27 06/13/2017 Workqueue: writeback wb_workfn (flush-7:2) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : native_queued_spin_lock_slowpath+0x358/0x418 lr : jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] Call trace: native_queued_spin_lock_slowpath+0x358/0x418 jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] __jbd2_log_wait_for_space+0xfc/0x2f8 [jbd2] add_transaction_credits+0x3bc/0x418 [jbd2] start_this_handle+0xf8/0x560 [jbd2] jbd2__journal_start+0x118/0x228 [jbd2] __ext4_journal_start_sb+0x110/0x188 [ext4] ext4_do_writepages+0x3dc/0x740 [ext4] ext4_writepages+0xa4/0x190 [ext4] do_writepages+0x94/0x228 __writeback_single_inode+0x48/0x318 writeback_sb_inodes+0x204/0x590 __writeback_inodes_wb+0x54/0xf8 wb_writeback+0x2cc/0x3d8 wb_do_writeback+0x2e0/0x2f8 wb_workfn+0x80/0x2a8 process_one_work+0x178/0x3e8 worker_thread+0x234/0x3b8 kthread+0xf0/0x108 ret_from_fork+0x10/0x20 So explicitly call cond_resched() in jbd2_log_do_checkpoint() to avoid softlockup.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39783\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix configfs group list head handling Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, not a list entry. This list_del() call triggers a KASAN warning when an endpoint function driver which has a configfs attribute group is torn down: ================================================================== BUG: KASAN: slab-use-after-free in pci_epf_remove_cfs+0x17c/0x198 Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319 CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE Hardware name: Radxa ROCK 5B (DT) Call trace: show_stack+0x2c/0x84 (C) dump_stack_lvl+0x70/0x98 print_report+0x17c/0x538 kasan_report+0xb8/0x190 __asan_report_store8_noabort+0x20/0x2c pci_epf_remove_cfs+0x17c/0x198 pci_epf_unregister_driver+0x18/0x30 nvmet_pci_epf_cleanup_module+0x24/0x30 [nvmet_pci_epf] __arm64_sys_delete_module+0x264/0x424 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xac/0x230 do_el0_svc+0x40/0x58 el0_svc+0x48/0xdc el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c ... Remove this incorrect list_del() call from pci_epf_remove_cfs().\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39787\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdt_loader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39788\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the driver ends up programming the UTRL_NEXUS_TYPE incorrectly as 0. This is because the left hand side of the shift is 1, which is of type int, i.e. 31 bits wide. Shifting by more than that width results in undefined behaviour. Fix this by switching to the BIT() macro, which applies correct type casting as required. This ensures the correct value is written to UTRL_NEXUS_TYPE (0xffffffff on gs101), and it also fixes a UBSAN shift warning: UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21 shift exponent 32 is too large for 32-bit type 'int' For consistency, apply the same change to the nutmrs / UTMRL_NEXUS_TYPE write.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39790\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a read pointer that is multiple elements ahead of the host's read pointer. For instance, if the host accesses an event ring while the device is updating it, the pointer inside of the event might still point to an old TRE. If the host uses the channel's xfer_cb() to directly free the buffer pointed to by the TRE, the buffer will be double-freed. This behavior was observed on an ep that used upstream EP stack without 'commit 6f18d174b73d (\"bus: mhi: ep: Update read pointer only after buffer is written\")'. Where the device updated the events ring pointer before updating the event contents, so it left a window where the host was able to access the stale data the event pointed to, before the device had the chance to update them. The usual pattern was that the host received an event pointing to a TRE that is not immediately after the last processed one, so it got treated as if it was a chained transaction, processing all of the TREs in between the two read pointers. This commit aims to harden the host by ensuring transactions where the event points to a TRE that isn't local_rp + 1 are chained. [mani: added stable tag and reworded commit message]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-415 Double Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.7\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39794\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ARM: tegra: Use I/O memcpy to write to IRAM Kasan crashes the kernel trying to check boundaries when using the normal memcpy.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39795\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: block: avoid possible overflow for chunk_sectors check in blk_stack_limits() In blk_stack_limits(), we check that the t->chunk_sectors value is a multiple of the t->physical_block_size value. However, by finding the chunk_sectors value in bytes, we may overflow the unsigned int which holds chunk_sectors, so change the check to be based on sectors.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-674 Uncontrolled Recursion\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39798\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: NFS: Fix the setting of capabilities when automounting a new filesystem Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, and then probed for again.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-273 Improper Check for Dropped Privileges\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39800\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() If we find an unexpected generation for the extent buffer we are cloning at btrfs_copy_root(), we just WARN_ON() and don't error out and abort the transaction, meaning we allow to persist metadata with an unexpected generation. Instead of warning only, abort the transaction and return -EUCLEAN.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39801\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: usb: dwc3: Remove WARN_ON for device endpoint command timeouts This commit addresses a rarely observed endpoint command timeout which causes kernel panic due to warn when 'panic_on_warn' is enabled and unnecessary call trace prints when 'panic_on_warn' is disabled. It is seen during fast software-controlled connect/disconnect testcases. The following is one such endpoint command timeout that we observed: 1. Connect ======= ->dwc3_thread_interrupt ->dwc3_ep0_interrupt ->configfs_composite_setup ->composite_setup ->usb_ep_queue ->dwc3_gadget_ep0_queue ->__dwc3_gadget_ep0_queue ->__dwc3_ep0_do_control_data ->dwc3_send_gadget_ep_cmd 2. Disconnect ========== ->dwc3_thread_interrupt ->dwc3_gadget_disconnect_interrupt ->dwc3_ep0_reset_state ->dwc3_ep0_end_control_data ->dwc3_send_gadget_ep_cmd In the issue scenario, in Exynos platforms, we observed that control transfers for the previous connect have not yet been completed and end transfer command sent as a part of the disconnect sequence and processing of USB_ENDPOINT_HALT feature request from the host timeout. This maybe an expected scenario since the controller is processing EP commands sent as a part of the previous connect. It maybe better to remove WARN_ON in all places where device endpoint commands are sent to avoid unnecessary kernel panic due to warn.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39806\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes. mt_report_fixup() attempts to patch byte offset 607 of the descriptor with 0x25 by first checking if byte offset 607 is 0x15 however it lacks bounds checks to verify if the descriptor is big enough before conducting this check. Fix this bug by ensuring the descriptor size is at least 608 bytes before accessing it. Below is the KASAN splat after the out of bounds access happens: [ 13.671954] ================================================================== [ 13.672667] BUG: KASAN: slab-out-of-bounds in mt_report_fixup+0x103/0x110 [ 13.673297] Read of size 1 at addr ffff888103df39df by task kworker/0:1/10 [ 13.673297] [ 13.673297] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-00005-gec5d573d83f4-dirty #3 [ 13.673297] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/04 [ 13.673297] Call Trace: [ 13.673297] [ 13.673297] dump_stack_lvl+0x5f/0x80 [ 13.673297] print_report+0xd1/0x660 [ 13.673297] kasan_report+0xe5/0x120 [ 13.673297] __asan_report_load1_noabort+0x18/0x20 [ 13.673297] mt_report_fixup+0x103/0x110 [ 13.673297] hid_open_report+0x1ef/0x810 [ 13.673297] mt_probe+0x422/0x960 [ 13.673297] hid_device_probe+0x2e2/0x6f0 [ 13.673297] really_probe+0x1c6/0x6b0 [ 13.673297] __driver_probe_device+0x24f/0x310 [ 13.673297] driver_probe_device+0x4e/0x220 [ 13.673297] __device_attach_driver+0x169/0x320 [ 13.673297] bus_for_each_drv+0x11d/0x1b0 [ 13.673297] __device_attach+0x1b8/0x3e0 [ 13.673297] device_initial_probe+0x12/0x20 [ 13.673297] bus_probe_device+0x13d/0x180 [ 13.673297] device_add+0xe3a/0x1670 [ 13.673297] hid_add_device+0x31d/0xa40 [...]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39808\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger page fault error for address(0xffffffffffffff58) add null check logic to ntrig_report_version() before calling hid_to_usb_dev()\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39812\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior. Clear sin6_scope_id and sin6_flowinfo. BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390 sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452 sctp_get_port net/sctp/socket.c:8523 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable addr.i.i created at: sctp_get_port net/sctp/socket.c:8515 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39813\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition. The issue occurs because: CPU0 (ftrace_dump) CPU1 (reader) echo z > /proc/sysrq-trigger !trace_empty(&iter) trace_iterator_reset(&iter) <- len = size = 0 cat /sys/kernel/tracing/trace_pipe trace_find_next_entry_inc(&iter) __find_next_entry ring_buffer_empty_cpu <- all empty return NULL trace_printk_seq(&iter.seq) WARN_ON_ONCE(s->seq.len >= s->seq.size) In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers. This caused trace_find_next_entry_inc to return NULL, failing to populate `iter.seq`. At this point, due to the prior trace_iterator_reset, both `iter.seq.len` and `iter.seq.size` were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered. Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39817\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe8/0x190 __asan_loadN+0x1c/0x28 memcmp+0x98/0xd0 efivarfs_d_compare+0x68/0xd8 __d_lookup_rcu_op_compare+0x178/0x218 __d_lookup_rcu+0x1f8/0x228 d_alloc_parallel+0x150/0x648 lookup_open.isra.0+0x5f0/0x8d0 open_last_lookups+0x264/0x828 path_openat+0x130/0x3f8 do_filp_open+0x114/0x248 do_sys_openat2+0x340/0x3c0 __arm64_sys_openat+0x120/0x1a0 If dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become negative, leadings to oob. The issue can be triggered by parallel lookups using invalid filename: T1 T2 lookup_open ->lookup simple_lookup d_add // invalid dentry is added to hash list lookup_open d_alloc_parallel __d_lookup_rcu __d_lookup_rcu_op_compare hlist_bl_for_each_entry_rcu // invalid dentry can be retrieved ->d_compare efivarfs_d_compare // oob Fix it by checking 'guid' before cmp.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39819\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs/smb: Fix inconsistent refcnt update A possible inconsistent update of refcount was identified in `smb2_compound_op`. Such inconsistent update could lead to possible resource leaks. Why it is a possible bug: 1. In the comment section of the function, it clearly states that the reference to `cfile` should be dropped after calling this function. 2. Every control flow path would check and drop the reference to `cfile`, except the patched one. 3. Existing callers would not handle refcount update of `cfile` if -ENOMEM is returned. To fix the bug, an extra goto label \"out\" is added, to make sure that the cleanup logic would always be respected. As the problem is caused by the allocation failure of `vars`, the cleanup logic between label \"finished\" and \"out\" can be safely ignored. According to the definition of function `is_replayable_error`, the error code of \"-ENOMEM\" is not recoverable. Therefore, the replay logic also gets ignored.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39823\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39824\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device. This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees. 0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection Below is the KASAN splat after triggering the UAF: [ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700] __kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700] __kasan_slab_free+0x3c/0x50 [ 21.673700] kfre ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39825\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file. Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39826\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths. For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues. This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39827\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net: rose: include node references in rose_neigh refcount Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock. This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of rose_neigh->use when rose_neigh->count is incremented or decremented. This patch also modifies rose_rt_free(), rose_rt_device_down() and rose_clear_route() to properly release references to rose_neigh objects before freeing a rose_node through rose_remove_node(). These changes ensure rose_neigh structures are properly freed only when all references, including those from rose_node structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39828\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). syzbot reported the splat below. [0] When atmtcp_v_open() or atmtcp_v_close() is called via connect() or close(), atmtcp_send_control() is called to send an in-kernel special message. The message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length. Also, a pointer of struct atm_vcc is set to atmtcp_control.vcc. The notable thing is struct atmtcp_control is uAPI but has a space for an in-kernel pointer. struct atmtcp_control { struct atmtcp_hdr hdr; /* must be first */ ... atm_kptr_t vcc; /* both directions */ ... } __ATM_API_ALIGN; typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t; The special message is processed in atmtcp_recv_control() called from atmtcp_c_send(). atmtcp_c_send() is vcc->dev->ops->send() and called from 2 paths: 1. .ndo_start_xmit() (vcc->send() == atm_send_aal0()) 2. vcc_sendmsg() The problem is sendmsg() does not validate the message length and userspace can abuse atmtcp_recv_control() to overwrite any kptr by atmtcp_control. Let's add a new ->pre_send() hook to validate messages from sendmsg(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI KASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f] CPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline] RIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297 Code: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c RSP: 0018:ffffc90003f5f810 EFLAGS: 00010203 RAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c RBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd R10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000 R13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff FS: 00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0 Call Trace: vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8d7e96a4a9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9 RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005 RBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac R13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250 Modules linked in:\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39835\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: xfs: do not propagate ENODATA disk errors into xattr code ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code; namely, that the requested attribute name could not be found. However, a medium error from disk may also return ENODATA. At best, this medium error may escape to userspace as \"attribute not found\" when in fact it's an IO (disk) error. At worst, we may oops in xfs_attr_leaf_get() when we do: error = xfs_attr_leaf_hasname(args, &bp); if (error == -ENOATTR) { xfs_trans_brelse(args->trans, bp); return error; } because an ENODATA/ENOATTR error from disk leaves us with a null bp, and the xfs_trans_brelse will then null-deref it. As discussed on the list, we really need to modify the lower level IO functions to trap all disk errors and ensure that we don't let unique errors like this leak up into higher xfs functions - many like this should be remapped to EIO. However, this patch directly addresses a reported bug in the xattr code, and should be safe to backport to stable kernels. A larger-scope patch to handle more unique errors at lower levels can follow later. (Note, prior to 07120f1abdff we did not oops, but we did return the wrong error code to userspace.)\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39838\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash. This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and returns NULL early to prevent dereferencing NULL pointer. Found by Linux Verification Center (linuxtesting.org) with SVACE\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39839\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39841\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF. Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39842\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already been executed in ocfs2_dismount_volume(), so osb->journal must be NULL. Therefore, the following calltrace will inevitably fail when it reaches jbd2_journal_release_jbd_inode(). ocfs2_dismount_volume()-> ocfs2_delete_osb()-> ocfs2_free_slot_info()-> __ocfs2_free_slot_info()-> evict()-> ocfs2_evict_inode()-> ocfs2_clear_inode()-> jbd2_journal_release_jbd_inode(osb->journal->j_journal, Adding osb->journal checks will prevent null-ptr-deref during the above execution path.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39843\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but when enabled CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare, and try to hold the per_cpu(hrtimer_bases)[n].lock. Avoid deadlock caused by implicitly waking up kswapd by passing in allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the debug_objects_fill_pool() case. Inside stack depot they are processed by gfp_nested_mask(). Since ___slab_alloc() has preemption disabled, we mask out __GFP_DIRECT_RECLAIM from the flags there. The oops looks something like: BUG: spinlock recursion on CPU#3, swapper/3/0 lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3 Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT) Call trace: spin_bug+0x0 _raw_spin_lock_irqsave+0x80 hrtimer_try_to_cancel+0x94 task_contending+0x10c enqueue_dl_entity+0x2a4 dl_server_start+0x74 enqueue_task_fair+0x568 enqueue_task+0xac do_activate_task+0x14c ttwu_do_activate+0xcc try_to_wake_up+0x6c8 default_wake_function+0x20 autoremove_wake_function+0x1c __wake_up+0xac wakeup_kswapd+0x19c wake_all_kswapds+0x78 __alloc_pages_slowpath+0x1ac __alloc_pages_noprof+0x298 stack_depot_save_flags+0x6b0 stack_depot_save+0x14 set_track_prepare+0x5c ___slab_alloc+0xccc __kmalloc_cache_noprof+0x470 __set_page_owner+0x2bc post_alloc_hook[jt]+0x1b8 prep_new_page+0x28 get_page_from_freelist+0x1edc __alloc_pages_noprof+0x13c alloc_slab_page+0x244 allocate_slab+0x7c ___slab_alloc+0x8e8 kmem_cache_alloc_noprof+0x450 debug_objects_fill_pool+0x22c debug_object_activate+0x40 enqueue_hrtimer[jt]+0xdc hrtimer_start_range_ns+0x5f8 ...\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39844\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: mm: move page table sync declarations to linux/pgtable.h During our internal testing, we started observing intermittent boot failures when the machine uses 4-level paging and has a large amount of persistent memory: BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] It turns out that the kernel panics while initializing vmemmap (struct page array) when the vmemmap region spans two PGD entries, because the new PGD entry is only installed in init_mm.pgd, but not in the page tables of other tasks. And looking at __populate_section_memmap(): if (vmemmap_can_optimize(altmap, pgmap)) // does not sync top level page tables r = vmemmap_populate_compound_pages(pfn, start, end, nid, pgmap); else // sync top level page tables in x86 r = vmemmap_populate(start, end, nid, altmap); In the normal path, vmemmap_populate() in arch/x86/mm/init_64.c synchronizes the top level page table (See commit 9b861528a801 (\"x86-64, mem: Update all PGDs for direct mapping and vmemmap mapping changes\")) so that all tasks in the system can see the new vmemmap area. However, when vmemmap_can_optimize() returns true, the optimized path skips synchronization of top-level page tables. This is because vmemmap_populate_compound_pages() is implemented in core MM code, which does not handle synchronization of the top-level page tables. Instead, the core MM has historically relied on each architecture to perform this synchronization manually. We're not the first party to encounter a crash caused by not-sync'd top level page tables: earlier this year, Gwan-gyeong Mun attempted to address the issue [1] [2] after hitting a kernel panic when x86 code accessed the vmemmap area before the corresponding top-level entries were synced. At that time, the issue was believed to be triggered only when struct page was enlarged for debugging purposes, and the patch did not get further updates. It turns out that current approach of relying on each arch to handle the page table sync manually is fragile because 1) it's easy to forget to sync the top level page table, and 2) it's also easy to overlook that the kernel should not access the vmemmap and direct mapping areas before the sync. # The solution: Make page table sync more code robust and harder to miss To address this, Dave Hansen suggested [3] [4] introducing {pgd,p4d}_populate_kernel() for updating kernel portion of the page tables and allow each architecture to explicitly perform synchronization when installing top-level entries. With this approach, we no longer need to worry about missing the sync step, reducing the risk of future regressions. The new interface reuses existing ARCH_PAGE_TABLE_SYNC_MASK, PGTBL_P*D_MODIFIED and arch_sync_kernel_mappings() facility used by vmalloc and ioremap to synchronize page tables. pgd_populate_kernel() looks like this: static inline void pgd_populate_kernel(unsigned long addr, pgd_t *pgd, p4d_t *p4d) { pgd_populate(&init_mm, pgd, p4d); if (ARCH_PAGE_TABLE_SYNC_MASK & PGTBL_PGD_MODIFIED) arch_sync_kernel_mappings(addr, addr); } It is worth noting that vmalloc() and apply_to_range() carefully synchronizes page tables by calling p*d_alloc_track() and arch_sync_kernel_mappings(), and thus they are not affected by ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39845\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() Define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to ensure page tables are properly synchronized when calling p*d_populate_kernel(). For 5-level paging, synchronization is performed via pgd_populate_kernel(). In 4-level paging, pgd_populate() is a no-op, so synchronization is instead performed at the P4D level via p4d_populate_kernel(). This fixes intermittent boot failures on systems using 4-level paging and a large amount of persistent memory: BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] It also fixes a crash in vmemmap_set_pmd() caused by accessing vmemmap before sync_global_pgds() [1]: BUG: unable to handle page fault for address: ffffeb3ff1200000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: Oops: 0002 [#1] PREEMPT SMP NOPTI Tainted: [W]=WARN RIP: 0010:vmemmap_set_pmd+0xff/0x230 vmemmap_populate_hugepages+0x176/0x180 vmemmap_populate+0x34/0x80 __populate_section_memmap+0x41/0x90 sparse_add_section+0x121/0x3e0 __add_pages+0xba/0x150 add_pages+0x1d/0x70 memremap_pages+0x3dc/0x810 devm_memremap_pages+0x1c/0x60 xe_devm_add+0x8b/0x100 [xe] xe_tile_init_noalloc+0x6a/0x70 [xe] xe_device_probe+0x48c/0x740 [xe] [... snip ...]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39846\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() In __iodyn_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource(). Fix this bug by adding a check of res.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39847\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ppp: fix memory leak in pad_compress_skb If alloc_skb() fails in pad_compress_skb(), it returns NULL without releasing the old skb. The caller does: skb = pad_compress_skb(ppp, skb); if (!skb) goto drop; drop: kfree_skb(skb); When pad_compress_skb() returns NULL, the reference to the old skb is lost and kfree_skb(skb) ends up doing nothing, leading to a memory leak. Align pad_compress_skb() semantics with realloc(): only free the old skb if allocation and compression succeed. At the call site, use the new_skb variable so the original skb is not lost when pad_compress_skb() fails.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-772 Missing Release of Resource after Effective Lifetime\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39848\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d (\"net: introduce per netns packet chains\"). skb->dev becomes NULL and we crash in __netif_receive_skb_core(). Before above commit, different kind of bugs or corruptions could happen without a major crash. But the root cause is that ax25_kiss_rcv() can queue/mangle input skb without checking if this skb is shared or not. Many thanks to Bernard Pidoux for his help, diagnosis and tests. We had a similar issue years ago fixed with commit 7aaed57c5c28 (\"phonet: properly unshare skbs in phonet_rcv()\").\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39849\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checking.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39853\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. Fix this by using list_first_entry_or_null instead of list_first_entry.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39857\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G OE 6.17.0-rc2+ #9 NONE Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Workqueue: smc_hs_wq smc_listen_work [smc] RIP: 0010:smc_ib_is_sg_need_sync+0x9e/0xd0 [smc] ... Call Trace: smcr_buf_map_link+0x211/0x2a0 [smc] __smc_buf_create+0x522/0x970 [smc] smc_buf_create+0x3a/0x110 [smc] smc_find_rdma_v2_device_serv+0x18f/0x240 [smc] ? smc_vlan_by_tcpsk+0x7e/0xe0 [smc] smc_listen_find_device+0x1dd/0x2b0 [smc] smc_listen_work+0x30f/0x580 [smc] process_one_work+0x18c/0x340 worker_thread+0x242/0x360 kthread+0xe7/0x220 ret_from_fork+0x13a/0x160 ret_from_fork_asm+0x1a/0x30 If the software RoCE device is used, ibdev->dma_device is a null pointer. As a result, the problem occurs. Null pointer detection is added to prevent problems.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39860\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the \"Freed by task\" part. Let's call l2cap_sock_cleanup_listen() under lock_sock() in l2cap_sock_release(). [0]: BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 Read of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995 CPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 spin_lock_bh include/linux/spinlock.h:356 [inline] release_sock+0x21/0x220 net/core/sock.c:3746 bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2accf8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f R10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c R13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490 Allocated by task 5326: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4365 [inline] __kmalloc_nopro ---truncated---\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.1\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39864\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f (\"cfg80211: track hidden SSID networks properly\"), adjust cfg80211_update_known_bss() to free the last beacon frame elements only if they're not shared via the corresponding 'hidden_beacon_bss' pointer.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39865\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: tee: fix NULL pointer dereference in tee_shm_put tee_shm_put have NULL pointer dereference: __optee_disable_shm_cache --> shm = reg_pair_to_ptr(...);//shm maybe return NULL tee_shm_free(shm); --> tee_shm_put(shm);//crash Add check in tee_shm_put to fix it. panic log: Unable to handle kernel paging request at virtual address 0000000000100cca Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 [0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- 6.6.0-39-generic #38 Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 10/26/2022 pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tee_shm_put+0x24/0x188 lr : tee_shm_free+0x14/0x28 sp : ffff001f98f9faf0 x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca Call trace: tee_shm_put+0x24/0x188 tee_shm_free+0x14/0x28 __optee_disable_shm_cache+0xa8/0x108 optee_shutdown+0x28/0x38 platform_shutdown+0x28/0x40 device_shutdown+0x144/0x2b0 kernel_power_off+0x3c/0x80 hibernate+0x35c/0x388 state_store+0x64/0x80 kobj_attr_store+0x14/0x28 sysfs_kf_write+0x48/0x60 kernfs_fop_write_iter+0x128/0x1c0 vfs_write+0x270/0x370 ksys_write+0x6c/0x100 __arm64_sys_write+0x20/0x30 invoke_syscall+0x4c/0x120 el0_svc_common.constprop.0+0x44/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x24/0x88 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x14c/0x15\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-39866\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mark_inode_dirty+0x124/0x418 lr : __mark_inode_dirty+0x118/0x418 sp : ffffffc08c9dbbc0 ........ Call trace: __mark_inode_dirty+0x124/0x418 generic_update_time+0x4c/0x60 file_modified+0xcc/0xd0 ext4_buffered_write_iter+0x58/0x124 ext4_file_write_iter+0x54/0x704 vfs_write+0x1c0/0x308 ksys_write+0x74/0x10c __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x40/0xe4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x194/0x198 Root cause is: systemd-random-seed kworker ---------------------------------------------------------------------- ___mark_inode_dirty inode_switch_wbs_work_fn spin_lock(&inode->i_lock); inode_attach_wb locked_inode_to_wb_and_lock_list get inode->i_wb spin_unlock(&inode->i_lock); spin_lock(&wb->list_lock) spin_lock(&inode->i_lock) inode_io_list_move_locked spin_unlock(&wb->list_lock) spin_unlock(&inode->i_lock) spin_lock(&old_wb->list_lock) inode_do_switch_wbs spin_lock(&inode->i_lock) inode->i_wb = new_wb spin_unlock(&inode->i_lock) spin_unlock(&old_wb->list_lock) wb_put_many(old_wb, nr_switched) cgwb_release old wb released wb_wakeup_delayed() accesses wb, then trigger the use-after-free issue Fix this race condition by holding inode spinlock until wb_wakeup_delayed() finished.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.8\nHIGH\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-40300\n<div class=\"csaf-accordion-content\">\n\nIn the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest. Userspace can additionally be protected by flushing the branch predictors after a VMexit. Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and userspace will incur the most overhead from the new IBPB. This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is doubled up: one at context switch and another before running userspace. The intent is to integrate and optimize these cases post-embargo. [ dhansen: elaborate on suboptimal IBPB solution ]\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-402 Transmission of Private Resources into a New Sphere ('Resource Leak')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.5\nMEDIUM\nCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-43368\n<div class=\"csaf-accordion-content\">\n\nA use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26, iOS 26 and iPadOS 26, macOS Tahoe 26. Processing maliciously crafted web content may lead to an unexpected Safari crash.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.3\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-47219\n<div class=\"csaf-accordion-content\">\n\nIn GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading to information disclosure.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-125 Out-of-bounds Read\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n8.1\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-48989\n<div class=\"csaf-accordion-content\">\n\nImproper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older, EOL versions may also be affected. Users are recommended to upgrade to one of versions 11.0.10, 10.1.44 or 9.0.108 which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-404 Improper Resource Shutdown or Release\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-53057\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-284 Improper Access Control\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.9\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-53066\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16 and 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-55752\n<div class=\"csaf-accordion-content\">\n\nRelative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-23 Relative Path Traversal\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-55754\n<div class=\"csaf-accordion-content\">\n\nImproper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a specially crafted URL to inject ANSI escape sequences to manipulate the console and the clipboard and attempt to trick an administrator into running an attacker controlled command. While no attack vector was found, it may have been possible to mount this attack on other operating systems. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.40 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.60 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n9.6\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-61748\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 21.0.8 and 25; Oracle GraalVM for JDK: 21.0.8; Oracle GraalVM Enterprise Edition: 21.3.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-284 Improper Access Control\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.7\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2025-61795\n<div class=\"csaf-accordion-content\">\n\nImproper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.11, from 10.1.0-M1 through 10.1.46, from 9.0.0.M1 through 9.0.109. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.12 or later, 10.1.47 or later or 9.0.110 or later which fixes the issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-404 Improper Resource Shutdown or Release\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n5.3\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-2673\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected preferred key exchange group when its key exchange group configuration includes the default by using the 'DEFAULT' keyword. Impact summary: A less preferred key exchange may be used even when a more preferred group is supported by both client and server, if the group was not included among the client's initial predicated keyshares. This will sometimes be the case with the new hybrid post-quantum groups, if the client chooses to defer their use until specifically requested by the server. If an OpenSSL TLS 1.3 server's configuration uses the 'DEFAULT' keyword to interpolate the built-in default group list into its own configuration, perhaps adding or removing specific elements, then an implementation defect causes the 'DEFAULT' list to lose its 'tuple' structure, and all server-supported groups were treated as a single sufficiently secure 'tuple', with the server not sending a Hello Retry Request (HRR) even when a group in a more preferred tuple was mutually supported. As a result, the client and server might fail to negotiate a mutually supported post-quantum key agreement group, such as 'X25519MLKEM768', if the client's configuration results in only 'classical' groups (such as 'X25519' being the only ones in the client's initial keyshare prediction). OpenSSL 3.5 and later support a new syntax for selecting the most preferred TLS 1.3 key agreement group on TLS servers. The old syntax had a single 'flat' list of groups, and treated all the supported groups as sufficiently secure. If any of the keyshares predicted by the client were supported by the server the most preferred among these was selected, even if other groups supported by the client, but not included in the list of predicted keyshares would have been more preferred, if included. The new syntax partitions the groups into distinct 'tuples' of roughly equivalent security. Within each tuple the most preferred group included among the client's predicted keyshares is chosen, but if the client supports a group from a more preferred tuple, but did not predict any corresponding keyshares, the server will ask the client to retry the ClientHello (by issuing a Hello Retry Request or HRR) with the most preferred mutually supported group. The above works as expected when the server's configuration uses the built-in default group list, or explicitly defines its own list by directly defining the various desired groups and group 'tuples'. No OpenSSL FIPS modules are affected by this issue, the code in question lies outside the FIPS boundary. OpenSSL 3.6 and 3.5 are vulnerable to this issue. OpenSSL 3.6 users should upgrade to OpenSSL 3.6.2 once it is released. OpenSSL 3.5 users should upgrade to OpenSSL 3.5.6 once it is released. OpenSSL 3.4, 3.3, 3.0, 1.0.2 and 1.1.1 are not affected by this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21925\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: RMI). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 4.8 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n4.8\nMEDIUM\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21932\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT, JavaFX). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.4 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.4\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21933\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data as well as unauthorized read access to a subset of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-20 Improper Input Validation\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n6.1\nMEDIUM\nCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21945\n<div class=\"csaf-accordion-content\">\n\nVulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u471, 8u471-b50, 8u471-perf, 11.0.29, 17.0.17, 21.0.9, 25.0.1; Oracle GraalVM for JDK: 17.0.17 and 21.0.9; Oracle GraalVM Enterprise Edition: 21.3.16. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-400 Uncontrolled Resource Consumption\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-21947\n<div class=\"csaf-accordion-content\">\n\nVulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.1 Base Score 3.1 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N).\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n3.1\nLOW\nCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-22924\n<div class=\"csaf-accordion-content\">\n\nThe affected application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion conditions. This could allow an attacker to disrupt normal operations or perform unauthorized actions, potentially impacting system availability and integrity.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-306 Missing Authentication for Critical Function\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n9.1\nCRITICAL\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-22925\n<div class=\"csaf-accordion-content\">\n\nThe affected application is susceptible to resource exhaustion when subjected to high volume of TCP SYN packets This could allow an attacker to render the service unavailable and cause denial-of-service conditions by overwhelming system resources.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-770 Allocation of Resources Without Limits or Throttling\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28387\n<div class=\"csaf-accordion-content\">\n\nIssue summary: An uncommon configuration of clients performing DANE TLSA-based server authentication, when paired with uncommon server DANE TLSA records, may result in a use-after-free and/or double-free on the client side. Impact summary: A use after free can have a range of potential consequences such as the corruption of valid data, crashes or execution of arbitrary code. However, the issue only affects clients that make use of TLSA records with both the PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate usage. By far the most common deployment of DANE is in SMTP MTAs for which RFC7672 recommends that clients treat as 'unusable' any TLSA records that have the PKIX certificate usages. These SMTP (or other similar) clients are not vulnerable to this issue. Conversely, any clients that support only the PKIX usages, and ignore the DANE-TA(2) usage are also not vulnerable. The client would also need to be communicating with a server that publishes a TLSA RRset with both types of TLSA records. No FIPS modules are affected by this issue, the problem code is outside the FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-416 Use After Free\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28388\n<div class=\"csaf-accordion-content\">\n\nIssue summary: When a delta CRL that contains a Delta CRL Indicator extension is processed a NULL pointer dereference might happen if the required CRL Number extension is missing. Impact summary: A NULL pointer dereference can trigger a crash which leads to a Denial of Service for an application. When CRL processing and delta CRL processing is enabled during X.509 certificate verification, the delta CRL processing does not check whether the CRL Number extension is NULL before dereferencing it. When a malformed delta CRL file is being processed, this parameter can be NULL, causing a NULL pointer dereference. Exploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in the verification context, the certificate being verified to contain a freshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and an attacker to provide a malformed CRL to an application that processes it. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28389\n<div class=\"csaf-accordion-content\">\n\nIssue summary: During processing of a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is processed, the optional parameters field of KeyEncryptionAlgorithmIdentifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-28390\n<div class=\"csaf-accordion-content\">\n\nIssue summary: During processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo a NULL pointer dereference can happen. Impact summary: Applications that process attacker-controlled CMS data may crash before authentication or cryptographic operations occur resulting in Denial of Service. When a CMS EnvelopedData message that uses KeyTransportRecipientInfo with RSA-OAEP encryption is processed, the optional parameters field of RSA-OAEP SourceFunc algorithm identifier is examined without checking for its presence. This results in a NULL pointer dereference if the field is missing. Applications and services that call CMS_decrypt() on untrusted input (e.g., S/MIME processing or CMS-based protocols) are vulnerable. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-476 NULL Pointer Dereference\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-31789\n<div class=\"csaf-accordion-content\">\n\nIssue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or possibly an attacker controlled code execution or other undefined behavior. If an attacker can supply a crafted X.509 certificate with an excessively large OCTET STRING value in extensions such as the Subject Key Identifier (SKID) or Authority Key Identifier (AKID) which are being converted to hex, the size of the buffer needed for the result is calculated as multiplication of the input length by 3. On 32 bit platforms, this multiplication may overflow resulting in the allocation of a smaller buffer and a heap buffer overflow. Applications and services that print or log contents of untrusted X.509 certificates are vulnerable to this issue. As the certificates would have to have sizes of over 1 Gigabyte, printing or logging such certificates is a fairly unlikely operation and only 32 bit platforms are affected, this issue was assigned Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-787 Out-of-bounds Write\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7\nHIGH\nCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H\n\n\n\n</div>\n</div>\n</div>\n<div class=\"csaf-accordion-item\">\n\nCVE-2026-31790\n<div class=\"csaf-accordion-content\">\n\nIssue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer. Impact summary: The uninitialized buffer might contain sensitive data from the previous execution of the application process which leads to sensitive data leakage to an attacker. RSA_public_encrypt() returns the number of bytes written on success and -1 on error. The affected code tests only whether the return value is non-zero. As a result, if RSA encryption fails, encapsulation can still return success to the caller, set the output lengths, and leave the caller to use the contents of the ciphertext buffer as if a valid KEM ciphertext had been produced. If applications use EVP_PKEY_encapsulate() with RSA/RSASVE on an attacker-supplied invalid RSA public key without first validating that key, then this may cause stale or uninitialized contents of the caller-provided ciphertext buffer to be disclosed to the attacker in place of the KEM ciphertext. As a workaround calling EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() will mitigate the issue. The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.1 and 3.0 are affected by this issue.\n\nView CVE Details\n\n\n\nAffected Products\n\nSiemens SIMATIC\n<div class=\"ics-vendor-version-status\">\n<div class=\"ics-vendor\">Vendor:Siemens</div>\n<div class=\"ics-version\">Product Version:SIMATIC CN 4100</div>\n<div class=\"ics-status\">Product Status:known_affected</div>\n</div>\n<div class=\"ics-remediations\">\n\nRemediations\n\nVendor fixUpdate to V5.0 or later versionhttps://support.industry.siemens.com/cs/ww/en/view/109814144/\n</div>\n\nRelevant CWE: CWE-754 Improper Check for Unusual or Exceptional Conditions\n\n\n\nMetrics\n<div class=\"csaf-table csaf-metrics-table\">\n\n\n\n\nCVSS Version\nBase Score\nBase Severity\nVector String\n\n\n\n\n3.1\n7.5\nHIGH\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n\n\n\n</div>\n</div>\n</div>\n</div>\n\n\n\nAcknowledgments\n\n\n\nSiemens ProductCERT reported these vulnerabilities to CISA.\n\n\n\n\nGeneral Recommendations\n\nAs a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity\n\n\n\nAdditional Resources\n\nFor further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories\n\n\n\nTerms of Use\n\nThe use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.\n\n\n\nLegal Notice and Terms of Use\n\nThis product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).\n\n\n\nRecommended Practices\n\nCISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.\n\nMinimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.\n\nLocate control system networks and remote devices behind firewalls and isolate them from business networks.\n\nWhen remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.\n\nCISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\n\nOrganizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.\n\n\n\nAdvisory Conversion Disclaimer\n\nThis ICSA is a verbatim republication of Siemens ProductCERT SSA-032379 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.\n\nRevision History\n\n\n\nInitial Release Date: 2026-05-12\n\n\n\n\n\nDate\nRevision\nSummary\n\n\n\n\n2026-05-12\n1\nPublication Date\n\n\n2026-05-14\n2\nInitial CISA Republication of Siemens ProductCERT SSA-032379 advisory\n\n\n\n\n\n\nLegal Notice and Terms of Use", "creation_timestamp": "2026-05-14T10:00:00.000000Z"}, {"uuid": "e8e76b96-8563-453d-b2c9-86d09680e4c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28517", "type": "seen", "source": "https://infosec.exchange/users/catc0n/statuses/116574230763721167", "content": "\u2757Earlier today, VulnCheck Canaries detected first-time exploitation of CVE-2026-28515 and CVE-2026-28517 in openDCIM, an open-source code base used for data center infrastructure management. \n\ud83d\udc1a The cluster of attacker activity we're observing so far originates from a single Chinese IP and uses what appears to be a customized implementation of AI vuln discovery tool Vulnhuntr to automatically check for vulnerable installations before dropping a PHP webshell. \n\ud83c\udf10 The VulnCheck team's ASM queries for these vulnerabilities find fewer than 50 systems online, many of which belong to higher education institutions globally. Both CVEs were discovered by new VulnCheck research team member @chocapikk_. \nMoar KEVs: https://www.vulncheck.com/kev", "creation_timestamp": "2026-05-14T18:02:13.286046Z"}, {"uuid": "bd20c7ff-ebe4-4fca-bc20-9b19c3cda8f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28986", "type": "seen", "source": "https://notnow.dev/objects/38d54cfe-6014-45b5-881f-055acd601dbd", "content": "Still diffing macOS 15.7.5 vs 15.7.7:\nOn 15.7.7, msgctl(IPC_SET), after getting the message queue and computing ipcperm, no longer drops its lock during the copyin:\nhttps://github.com/apple-oss-distributions/xnu/blob/f6217f891ac0bb64f3d375211650a4c1ff8ca1ea/bsd/kern/sysv_msg.c#L492\nSo maybe this is the race condition of CVE-2026-28986?", "creation_timestamp": "2026-05-15T02:56:35.244821Z"}, {"uuid": "e41eb3b9-501e-4d53-bd35-7a3f31d8ff21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28986", "type": "seen", "source": "https://notnow.dev/objects/2b0cf408-e92a-4489-9be1-9e4d21052426", "content": "OK, I\u2019m not smart enough to figure out if the msgctl(IPC_SET) is exploitable: an LLM outputs one plausible-sounding vector (https://gist.github.com/zhuowei/390b9e171641561f88ceb2119d984bc1), but I am not knowledgable to say whether it\u2019s doable or if it matches CVE-2026-28986.", "creation_timestamp": "2026-05-15T04:44:00.191052Z"}, {"uuid": "8cf5f85d-93ad-4f0e-bb67-27113b66b386", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28761", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116577063954695291", "content": "\u26a0\ufe0f HIGH severity: CVE-2026-28761 impacts Fujitsu Musetheque V4 for IPKNOWLEDGE (\u2264V4L1 rev2203.0). CSRF flaw allows unwanted actions if logged-in users visit malicious pages. Patch status unknown. https://radar.offseq.com/threat/cve-2026-28761-cross-site-request-forgery-csrf-in--3c8966ad #OffSeq #CSRF #Fujitsu #Vuln", "creation_timestamp": "2026-05-15T06:00:30.050618Z"}, {"uuid": "63638165-76b2-4d97-b383-5a7e0a7a2f18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28761", "type": "seen", "source": "https://jvn.jp/en/jp/JVN69128376", "content": "", "creation_timestamp": "2026-05-14T20:00:00.000000Z"}, {"uuid": "79613e4b-05f6-47b9-886c-cd0fa7813da8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28761", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mluss7f5tp2h", "content": "CVE-2026-28761 - Musetheque V4 Cross-Site Request Forgery (CSRF)\nCVE ID : CVE-2026-28761\n \n Published : May 15, 2026, 5:38 a.m. | 27\u00a0minutes ago\n \n Description : Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev220...", "creation_timestamp": "2026-05-15T07:32:54.938886Z"}, {"uuid": "3c6e7ed0-f358-41bd-97ae-f1f171d53d77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28920", "type": "seen", "source": "https://bsky.app/profile/infosecbot.bsky.social/post/3mluz7vsom726", "content": "CVE-2026-28920 (Apple, zlib, found by Brendon Tiszka of Google Project Zero) sure looks fun :)\n\n\ud83d\udd01 RT @ifsecure | reposted by @thegrugq\nhttps://x.com/ifsecure/status/2054495074696786365", "creation_timestamp": "2026-05-15T09:25:46.940352Z"}, {"uuid": "d160bc18-014f-49a8-bc28-82043a38902d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28956", "type": "seen", "source": "Telegram/AKvzzPS6cRH5e3-Ghbw0kwesBlioL1QWpK2eWbvMSndUnWE", "content": "", "creation_timestamp": "2026-05-17T15:00:07.000000Z"}, {"uuid": "35ec3bc7-f68e-48b7-afb8-deb7dd9cc36d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28759", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mm4hr67zby2q", "content": "CVE-2026-28759 - Insufficient authorization in shared channel membership sync allows remote cluster to remove users from arbitrary channels\nCVE ID : CVE-2026-28759\n \n Published : May 18, 2026, 6:50 a.m. | 1\u00a0hour, 21\u00a0minutes ago\n \n Description : Mattermost versions 11.5.x <=...", "creation_timestamp": "2026-05-18T08:34:40.740994Z"}, {"uuid": "e8e77504-0936-43e1-892a-91368cf3b364", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28516", "type": "seen", "source": "https://gist.github.com/stone776/ee5e28a52f7d95e7f2d58cb525abdce0", "content": "\n\n\n    \n    \n    TARDIS Intelligence Briefing -- 2026-05-19\n    \n    \n        *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }\n\n        :root {\n            --tardis-deep: #020b18;\n            --tardis-dark: #061627;\n            --tardis-mid: #0c2240;\n            --tardis-surface: #0f2a4a;\n            --tardis-panel: #132f52;\n            --tardis-edge: #1a3d66;\n            --tardis-blue: #1e6fba;\n            --tardis-blue-bright: #3498db;\n            --tardis-blue-glow: rgba(52, 152, 219, 0.15);\n            --tardis-gold: #f4c430;\n            --tardis-gold-dim: rgba(244, 196, 48, 0.12);\n            --tardis-amber: #e89e2d;\n            --tardis-green: #50c878;\n            --tardis-green-soft: rgba(80, 200, 120, 0.12);\n            --tardis-red: #e74c3c;\n            --tardis-text: #c8dce8;\n            --tardis-text-dim: #7a9ab8;\n            --tardis-text-muted: #4a6a85;\n        }\n\n        body {\n            background: var(--tardis-deep);\n            color: var(--tardis-text);\n            font-family: 'Rajdhani', sans-serif;\n            font-weight: 400;\n            min-height: 100vh;\n            line-height: 1.55;\n        }\n\n        ::-webkit-scrollbar { width: 5px; }\n        ::-webkit-scrollbar-track { background: var(--tardis-deep); }\n        ::-webkit-scrollbar-thumb { background: var(--tardis-edge); border-radius: 3px; }\n\n        .console-header {\n            background: var(--tardis-dark);\n            border-bottom: 2px solid var(--tardis-blue);\n            padding: 16px 36px;\n            display: flex;\n            align-items: center;\n            justify-content: space-between;\n            position: relative;\n            overflow: hidden;\n        }\n\n        .console-header::before {\n            content: '';\n            position: absolute;\n            top: 0; left: 0; right: 0;\n            height: 2px;\n            background: linear-gradient(90deg, transparent 0%, var(--tardis-blue-bright) 30%, var(--tardis-gold) 50%, var(--tardis-blue-bright) 70%, transparent 100%);\n        }\n\n        .console-brand { display: flex; align-items: center; gap: 14px; }\n\n        .tardis-icon {\n            width: 38px; height: 38px;\n            border: 2px solid var(--tardis-blue);\n            border-radius: 4px;\n            display: flex; align-items: center; justify-content: center;\n            background: var(--tardis-mid);\n            flex-shrink: 0;\n        }\n\n        .tardis-icon::before {\n            content: '';\n            width: 10px; height: 10px;\n            background: var(--tardis-gold);\n            border-radius: 50%;\n        }\n\n        .console-title-block { display: flex; flex-direction: column; gap: 2px; }\n\n        .console-title {\n            font-family: 'Orbitron', sans-serif;\n            font-size: 1.05em; font-weight: 700;\n            text-transform: uppercase; letter-spacing: 0.14em;\n            color: var(--tardis-gold);\n        }\n\n        .console-subtitle {\n            font-family: 'Share Tech Mono', monospace;\n            font-size: 0.7em; color: var(--tardis-text-dim);\n            text-transform: uppercase; letter-spacing: 0.18em;\n        }\n\n        .console-readout { display: flex; align-items: center; gap: 24px; }\n\n        .readout-date {\n            font-family: 'Share Tech Mono', monospace;\n            font-size: 1.1em; color: var(--tardis-gold); letter-spacing: 0.06em;\n        }\n\n        .readout-classification {\n            font-family: 'Orbitron', sans-serif;\n            font-size: 0.62em; font-weight: 700;\n            text-transform: uppercase; letter-spacing: 0.12em;\n            color: var(--tardis-text-dim);\n            background: var(--tardis-mid);\n            border: 1px solid var(--tardis-edge);\n            padding: 5px 14px; border-radius: 3px;\n        }\n\n        .weather-readout {\n            font-family: 'Share Tech Mono', monospace;\n            color: var(--tardis-text-dim); font-size: 0.85rem; letter-spacing: 0.5px;\n        }\n\n        .page-layout {\n            display: grid;\n            grid-template-columns: 200px 1fr;\n            min-height: calc(100vh - 74px);\n        }\n\n        .nav-sidebar {\n            background: var(--tardis-dark);\n            border-right: 1px solid var(--tardis-edge);\n            padding: 28px 0;\n            position: sticky; top: 0;\n            height: calc(100vh - 74px);\n            overflow-y: auto;\n        }\n\n        .nav-sidebar::-webkit-scrollbar { width: 3px; }\n        .nav-sidebar::-webkit-scrollbar-thumb { background: var(--tardis-edge); }\n\n        .nav-label {\n            font-family: 'Orbitron', sans-serif;\n            font-size: 0.58em; font-weight: 700;\n            text-transform: uppercase; letter-spacing: 0.2em;\n            color: var(--tardis-text-muted);\n            padding: 0 20px 12px;\n        }\n\n        .nav-item {\n            display: flex; align-items: center; gap: 10px;\n            padding: 9px 20px;\n            cursor: pointer;\n            border-left: 3px solid transparent;\n            text-decoration: none;\n            color: var(--tardis-text-dim);\n            font-family: 'Rajdhani', sans-serif;\n            font-size: 0.85em; font-weight: 500; line-height: 1.2;\n        }\n\n        .nav-item:hover {\n            color: var(--tardis-text);\n            background: var(--tardis-mid);\n            border-left-color: var(--tardis-blue-bright);\n        }\n\n        .nav-num {\n            font-family: 'Share Tech Mono', monospace;\n            font-size: 0.78em; color: var(--tardis-text-muted);\n            width: 18px; text-align: right; flex-shrink: 0;\n        }\n\n        .nav-divider { height: 1px; background: var(--tardis-edge); margin: 12px 20px; }\n\n        .main-content { padding: 32px 40px 60px; max-width: 900px; }\n\n        .section-chrome {\n            border: 1px solid var(--tardis-edge);\n            border-radius: 6px; overflow: hidden;\n            background: var(--tardis-dark);\n            margin-bottom: 28px;\n        }\n\n        .section-chrome-header {\n            background: var(--tardis-mid);\n            padding: 11px 18px;\n            display: flex; align-items: center; justify-content: space-between;\n            border-bottom: 1px solid var(--tardis-edge);\n        }\n\n        .section-chrome-label {\n            font-family: 'Orbitron', sans-serif;\n            font-size: 0.68em; font-weight: 700;\n            text-transform: uppercase; letter-spacing: 0.16em;\n            color: var(--tardis-text);\n            display: flex; align-items: center; gap: 9px;\n        }\n\n        .label-indicator {\n            width: 7px; height: 7px;\n            border-radius: 50%; background: var(--tardis-green); flex-shrink: 0;\n        }\n        .label-indicator.gold { background: var(--tardis-gold); }\n        .label-indicator.blue { background: var(--tardis-blue-bright); }\n        .label-indicator.red { background: var(--tardis-red); }\n        .label-indicator.amber { background: var(--tardis-amber); }\n\n        .section-chrome-badge {\n            font-family: 'Share Tech Mono', monospace;\n            font-size: 0.72em; color: var(--tardis-text-dim);\n            background: var(--tardis-dark);\n            padding: 2px 9px; border-radius: 3px;\n            border: 1px solid var(--tardis-edge);\n        }\n\n        .section-chrome-body { padding: 22px 24px; }\n\n        .bluf-block {\n            border-left: 3px solid var(--tardis-gold);\n            background: var(--tardis-gold-dim);\n            padding: 12px 16px; margin-bottom: 18px;\n            border-radius: 0 4px 4px 0;\n        }\n\n        .bluf-label {\n            font-family: 'Orbitron', sans-serif;\n            font-size: 0.58em; font-weight: 700;\n            text-transform: uppercase; letter-spacing: 0.2em;\n            color: var(--tardis-gold); margin-bottom: 5px;\n        }\n\n        .bluf-text {\n            font-family: 'Rajdhani', sans-serif;\n            font-size: 1.05em; font-weight: 600;\n            color: var(--tardis-text); line-height: 1.4;\n        }\n\n        .fact-list { list-style: none; margin-bottom: 16px; }\n\n        .fact-list li {\n            font-size: 0.97em; font-weight: 500;\n            color: var(--tardis-text);\n            padding: 5px 0 5px 18px;\n            position: relative; line-height: 1.45;\n            border-bottom: 1px solid rgba(26, 61, 102, 0.35);\n        }\n\n        .fact-list li:last-child { border-bottom: none; }\n\n        .fact-list li::before {\n            content: '';\n            position: absolute; left: 0; top: 13px;\n            width: 6px; height: 6px;\n            border: 1px solid var(--tardis-blue-bright);\n            border-radius: 1px; transform: rotate(45deg);\n        }\n\n        .fact-list .source-tag {\n            font-family: 'Share Tech Mono', monospace;\n            font-size: 0.78em; color: var(--tardis-text-muted); font-weight: 400;\n        }\n\n        .context-block {\n            background: var(--tardis-surface);\n            border: 1px solid var(--tardis-edge);\n            border-radius: 4px; padding: 12px 16px; margin-bottom: 14px;\n        }\n\n        .context-label {\n            font-family: 'Orbitron', sans-serif;\n            font-size: 0.58em; font-weight: 700;\n            text-transform: uppercase; letter-spacing: 0.18em;\n            color: var(--tardis-text-muted); margin-bottom: 6px;\n        }\n\n        .context-text {\n            font-family: 'Rajdhani', sans-serif;\n            font-size: 0.93em; color: var(--tardis-text-dim); line-height: 1.5;\n        }\n\n        .open-questions { margin-top: 12px; }\n\n        .open-questions-label {\n            font-family: 'Orbitron', sans-serif;\n            font-size: 0.58em; font-weight: 700;\n            text-transform: uppercase; letter-spacing: 0.18em;\n            color: var(--tardis-text-muted); margin-bottom: 7px;\n        }\n\n        .open-questions ul { list-style: none; }\n\n        .open-questions li {\n            font-family: 'Rajdhani', sans-serif;\n            font-size: 0.9em; color: var(--tardis-text-dim);\n            font-style: italic; padding: 3px 0 3px 14px; position: relative;\n        }\n\n        .open-questions li::before {\n            content: '?';\n            position: absolute; left: 0;\n            font-family: 'Share Tech Mono', monospace;\n            font-size: 0.85em; color: var(--tardis-amber); font-style: normal;\n        }\n\n        .data-table-wrap { overflow-x: auto; margin-bottom: 16px; }\n\n        table { width: 100%; border-collapse: collapse; font-size: 0.9em; }\n\n        thead { background: var(--tardis-surface); }\n\n        th {\n            font-family: 'Orbitron', sans-serif;\n            font-size: 0.62em; font-weight: 700;\n            text-transform: uppercase; letter-spacing: 0.12em;\n            color: var(--tardis-text-dim);\n            padding: 9px 14px; text-align: left;\n            border-bottom: 1px solid var(--tardis-edge);\n            white-space: nowrap;\n        }\n\n        td {\n            font-family: 'Share Tech Mono', monospace;\n            font-size: 0.88em; color: var(--tardis-text);\n            padding: 8px 14px;\n            border-bottom: 1px solid rgba(26, 61, 102, 0.4);\n            line-height: 1.35;\n        }\n\n        td.label-cell {\n            font-family: 'Rajdhani', sans-serif;\n            font-size: 0.93em; font-weight: 600; color: var(--tardis-text-dim);\n        }\n\n        td.positive { color: var(--tardis-green); }\n        td.negative { color: var(--tardis-red); }\n        td.neutral { color: var(--tardis-text-muted); }\n\n        tr:hover td { background: rgba(12, 34, 64, 0.5); }\n\n        .kev-block {\n            background: rgba(231, 76, 60, 0.07);\n            border: 1px solid rgba(231, 76, 60, 0.25);\n            border-radius: 4px; padding: 12px 16px; margin-bottom: 14px;\n        }\n\n        .kev-label {\n            font-family: 'Orbitron', sans-serif;\n            font-size: 0.6em; font-weight: 700;\n            text-transform: uppercase; letter-spacing: 0.18em;\n            color: var(--tardis-red); margin-bottom: 8px;\n        }\n\n        .kev-entry {\n            font-family: 'Rajdhani', sans-serif;\n            font-size: 0.93em; color: var(--tardis-text);\n            padding: 4px 0;\n            border-bottom: 1px solid rgba(231, 76, 60, 0.15);\n            line-height: 1.4;\n        }\n\n        .kev-entry:last-child { border-bottom: none; }\n        .kev-cve { font-family: 'Share Tech Mono', monospace; font-size: 0.88em; color: var(--tardis-red); }\n\n        .kev-none {\n            font-family: 'Rajdhani', sans-serif;\n            font-size: 0.93em; color: var(--tardis-text-muted); font-style: italic;\n        }\n\n        .analysis-chrome {\n            border: 1px solid var(--tardis-gold);\n            border-radius: 6px; overflow: hidden;\n            background: var(--tardis-dark); margin-bottom: 28px;\n        }\n\n        .analysis-chrome .section-chrome-header {\n            background: var(--tardis-gold-dim);\n            border-bottom-color: rgba(244, 196, 48, 0.25);\n        }\n\n        .analysis-subsection { margin-bottom: 18px; }\n        .analysis-subsection:last-child { margin-bottom: 0; }\n\n        .analysis-sublabel {\n            font-family: 'Orbitron', sans-serif;\n            font-size: 0.62em; font-weight: 700;\n            text-transform: uppercase; letter-spacing: 0.16em;\n            color: var(--tardis-gold); margin-bottom: 8px;\n            padding-bottom: 4px;\n            border-bottom: 1px solid rgba(244, 196, 48, 0.2);\n        }\n\n        .metadata-footer {\n            background: var(--tardis-dark);\n            border-top: 1px solid var(--tardis-edge);\n            padding: 18px 40px; margin-top: 8px;\n        }\n\n        .metadata-grid { display: flex; flex-wrap: wrap; gap: 20px 36px; }\n\n        .metadata-item { display: flex; flex-direction: column; gap: 2px; }\n\n        .metadata-key {\n            font-family: 'Orbitron', sans-serif;\n            font-size: 0.55em; font-weight: 700;\n            text-transform: uppercase; letter-spacing: 0.18em;\n            color: var(--tardis-text-muted);\n        }\n\n        .metadata-value {\n            font-family: 'Share Tech Mono', monospace;\n            font-size: 0.82em; color: var(--tardis-text-dim);\n        }\n    \n\n\n\n\n\n    \n\n        \n\n        \n\n            \nIntelligence Briefing\n            \nOSINT-First / IC Editorial Standards / CLAUDE Synthesis\n        \n    \n    \n\n        \n2026-05-19 \u00b7 Tuesday\n        \nOSINT Only\n        \nPartly Cloudy \u00b7 High 70.6\u00b0F / Low 51.9\u00b0F \u00b7 San Diego\n    \n\n\n\n\n    \n\n        \nSections\n        01AI Research\n        02Merlin Intelligence\n        03Military / Geo\n        04US News\n        05Economic\n        06Technology\n        07Cybersecurity\n        \n\n        13Analysis\n    \n\n    \n\n\n\n  \n\n    \n\n      \n      AI Research\n    \n    \nS1 \u00b7 ARXIV + LAB FEEDS\n  \n  \n\n\n    \n\n      \nBLUF\n      \nThree fresh papers address the agentic architecture layer directly: code-structured agent harnesses, skill generation quality benchmarking, and opportunistic parallelism in compound AI. A position paper challenges the single-judge safety assumption. All four have near-term implementation relevance.\n    \n\n    \n    \nCode as Agent Harness \u2014 Structured Dispatch Outperforms Prose Delegation\n    \n\n      \nLLMs orchestrating multi-step tasks achieve higher success rates when delegation is framed as code execution rather than natural-language instruction. The harness enforces sequencing, error capture, and retry logic. [ArXiv 2605.18747 \u00b7 2026-05-18]\n      \nKey finding: structured code harnesses reduce tool-skip hallucinations and out-of-order completions in multi-agent pipelines \u2014 the dominant failure mode in current orchestration systems.\n      \nImplementation path: wrap child agent dispatch in generated Python with typed inputs, structured error returns, and explicit blackboard write-backs rather than conversational handoffs.\n    \n    \n\n      \nOpen Questions\n      \n\n        \nDoes the harness pattern require the orchestrator model to be reliable at code generation, or does it work with structured templates the model fills in?\n      \n    \n\n    \n    \nSkillGenBench \u2014 Skill Generation Pipelines Require Held-Out Validation to Avoid Brittleness\n    \n\n      \nBenchmarks skill generation pipelines across generalizability, executability, and improvement rate. Pipelines that include a validation step \u2014 running generated skills against at least one held-out test before commit \u2014 show 2\u20133x fewer brittle skills in production. [ArXiv 2605.18693 \u00b7 2026-05-18]\n      \nCurrent Merlin Evolver loop lacks a structured pre-commit validation gate. This paper quantifies the cost of that gap.\n      \nPaper includes open-source benchmark harness applicable to any SKILL.md-style system.\n    \n\n    \n    \nPopPy \u2014 Implicit Parallelism in Compound AI Applications Extracted at Runtime\n    \n\n      \nDemonstrates that compound AI applications written in sequential Python contain substantial latent parallelism that a runtime can extract without programmer annotation. Mean 2.1x throughput improvement on representative workloads. [ArXiv 2605.18697 \u00b7 2026-05-18]\n      \nApplicable to Merlin's orchestrator multi-child dispatch: sequential agent calls that are data-independent can be parallelized by the runtime rather than requiring explicit async orchestration.\n      \nImplementation approach: introduce a PopPy-style dependency graph at the orchestrator level, letting the blackboard schema define data dependencies that constrain parallelism.\n    \n\n    \n    \nThree-Layer Safety Architecture \u2014 Single Judge Is Categorically Insufficient for LLM Agents\n    \n\n      \nPosition paper with probabilistic analysis argues that a single abstraction layer for LLM agent safety cannot distinguish confident-correct from confident-wrong from adversarially-manipulated outputs. A structurally independent second layer with different evidence basis is required. [ArXiv 2605.18672 \u00b7 2026-05-18]\n      \nDirect implication for Merlin: the Judge operating on agent self-reported output alone is insufficient. An Auditor using OTel span data \u2014 verifying that agents actually called the tools they claim to have called \u2014 constitutes an independent evidence basis and satisfies the paper's architectural requirement.\n      \nThe paper's three layers map to: (1) agent self-reporting, (2) external auditor with different evidence, (3) structural constraints in the environment (blackboard schema, tool permissions).\n    \n    \n\n      \nContext\n      \nAll four papers appeared May 18, 2026. ArXiv rotation window 9 (historical: March 10\u201317, 2026). No historical papers met the significance threshold for this window.\n    \n\n  \n\n\n\n\n  \n\n    \n\n      \n      Merlin Intelligence\n    \n    \nS2 \u00b7 FACTORY-INTERNAL\n  \n  \n\n\n    \n\n      \nBLUF\n      \nToday's ArXiv papers collectively close a loop Merlin hasn't yet closed: code-as-harness for agent dispatch, skill quality benchmarking, and the structural argument that a single Judge layer is insufficient for safe agent operation. The 314-npm supply chain attack adds an immediate operational action item: audit and pin all dependencies in the OpenHands container image.\n    \n\n    \n\n      \nFinding 1 \u2014 Code as Agent Harness [2605.18747] \u00b7 Orchestrator Dispatch Pattern\n      \n\n        What it shows: LLMs orchestrating multi-step tasks achieve substantially higher success rates when they frame subproblem delegation as code execution rather than conversational instruction \u2014 the harness structure enforces sequencing, error capture, and retry logic that prose prompts do not. [ArXiv 2605.18747]\n      \n      \n\n        Merlin component: Orchestrator child agent dispatch via AgentDelegateAction. Currently the orchestrator passes prose skill instructions. This paper argues that wrapping the delegation in a code harness \u2014 with explicit control flow, typed inputs, and structured error returns \u2014 reduces hallucinated skips and out-of-order completions.\n      \n      \n\n        Implementation idea: Replace the prose-instruction delegate pattern with a generated Python scaffold that calls child agents as functions, captures return values onto the blackboard, and handles failures with typed exceptions. The orchestrator generates this harness; the harness runs in OpenHands.\n      \n      \nBuild priority: [HIGH] \u2014 directly addresses the \"agents skip tools\" failure mode visible in OpenHands UI. Zero Golden Rule violations.\n    \n\n    \n\n      \nFinding 2 \u2014 SkillGenBench [2605.18693] \u00b7 SKILL.md Pipeline Quality\n      \n\n        What it shows: The paper benchmarks skill generation pipelines for LLM agents across three dimensions: generalizability (does the skill transfer to new tasks?), executability (does it run without errors?), and improvement rate (does Evolver produce better skills over iterations?). Key finding: pipelines that include a structured validation step \u2014 running the generated skill against at least one held-out test case before committing \u2014 show 2-3x fewer brittle skills in production. [ArXiv 2605.18693]\n      \n      \n\n        Merlin component: Evolver (SKILL.md evolution loop). Merlin currently lacks a structured validation gate between Evolver output and SKILL.md commit.\n      \n      \n\n        Implementation idea: Add a post-generation validation step to the Evolver loop: generate a synthetic test case from the skill's stated purpose, run the new skill against it in a sandboxed OpenHands session, and require a confidence \u226592 pass before committing to SKILL.md. Failed validations feed back as examples to the next Evolver iteration.\n      \n      \nBuild priority: [MEDIUM] \u2014 valuable for Phase 1 closure but not a current blocker. Plan for next sprint.\n    \n\n    \n\n      \nFinding 3 \u2014 Three-Layer Safety [2605.18672] \u00b7 Judge/Auditor Architecture\n      \n\n        What it shows: This position paper argues \u2014 with probabilistic analysis \u2014 that enforcing LLM agent safety within a single abstraction layer is categorically insufficient, not merely suboptimal. The argument: a single Judge operating on agent output cannot distinguish between confident-correct, confident-wrong, and adversarially-manipulated outputs. A second independent layer with a different evidence basis is structurally required. [ArXiv 2605.18672]\n      \n      \n\n        Merlin component: Judge/Auditor verification loop. Merlin uses a single Judge with confidence \u226592 threshold. This paper is a direct challenge to whether that's sufficient.\n      \n      \n\n        Implementation idea: Add an independent Auditor layer that evaluates Judge outputs using a different evidence basis \u2014 specifically, checking OTel span data (did the agent actually call the tools the Judge claims it called?) rather than relying solely on the agent's self-reported output. This is effectively already in the Merlin roadmap; this paper makes the case for prioritizing it.\n      \n      \nBuild priority: [HIGH] \u2014 architectural gap with probabilistic safety implications. The OTel-based auditor is the right implementation and aligns with Golden Rule 2 (Pervasive OTel).\n    \n\n    \n\n      \nFinding 4 \u2014 314 npm Supply Chain Attack \u00b7 Operational Action\n      \n\n        What it shows: 314 npm packages compromised in an active supply chain attack. Attack vector and specific packages not yet disclosed at time of collection. [HackerNews, May 19]\n      \n      \n\n        Merlin component: OpenHands Docker image and any Node.js tooling in the build pipeline. The Merlin factory uses npm for frontend tooling and potentially for generated product scaffolding.\n      \n      \n\n        Implementation idea: Immediate: run npm audit on the OpenHands container image and any Merlin scaffolding packages. Pin all npm dependencies to exact versions with hashed integrity checks in package-lock.json. Consider switching to a private npm mirror with pre-vetted package snapshots for production builds.\n      \n      \nBuild priority: [HIGH] \u2014 operational, not research. Do this before the next factory run.\n    \n\n    \n\n      \nOpen Questions\n      \n\n        \nDoes the code-as-harness pattern require OpenHands to support programmatic error-return capture, or can this be layered above via the blackboard schema?\n        \nIf the three-layer safety argument is correct, what is the minimum independent evidence basis for an Auditor that doesn't double the per-task LLM cost? OTel spans are the obvious answer \u2014 but are they sufficient as a distinct evidence source, or do they suffer from the same adversarial manipulation surface?\n      \n    \n\n  \n\n\n\n\n  \n\n    \n\n      \n      Military / Geopolitical\n    \n    \nS3 \u00b7 OSINT\n  \n  \n\n\n    \n\n      \nBLUF\n      \nIran issued a public threat to interfere with submarine cables in the Strait of Hormuz \u2014 the first explicit statement of this kind and a structural escalation of its coercive posture. Separately, the US suspended the joint defense advisory board with Canada, marking a measurable deterioration in a foundational alliance.\n    \n\n    \nIran Threatens Submarine Cable Interference in Strait of Hormuz\n    \n\n      \nIranian officials issued a public statement hinting at the ability and willingness to disrupt submarine communications cables passing through the Strait of Hormuz in response to US pressure. [The Register \u00b7 2026-05-19]\n      \nThe Strait of Hormuz carries a significant fraction of global submarine cable traffic between Europe, Asia, and the Gulf states. Disruption would affect internet connectivity across the Middle East and portions of South Asia.\n      \nThis is a qualitative escalation: Iran has threatened oil shipping before; threatening communications infrastructure targets a different category of critical systems and signals broader coercive reach.\n      \nNo disruption has occurred. The statement is assessed as a coercive signal rather than an imminent operational threat \u2014 but the explicit nature of the statement represents a new threshold.\n    \n    \n\n      \nContext\n      \nSubmarine cable disruption has been used previously by Russia (Baltic Sea, 2024) and suspected Houthi activity in the Red Sea (2024). Iran publicly claiming this capability in the Hormuz context signals awareness of the tactic's leverage. US-Iran nuclear negotiations remain ongoing and unresolved.\n    \n    \n\n      \nOpen Questions\n      \n\n        \nIs this a negotiating signal tied to nuclear talks, or a longer-term shift in Iran's coercive toolkit?\n        \nWhat redundant cable routing exists for Gulf-to-Asia traffic that would mitigate a Hormuz disruption?\n      \n    \n\n    \nUS Suspends Joint Defense Advisory Board with Canada\n    \n\n      \nThe Pentagon's policy chief announced Monday that the United States suspended the joint defense advisory board with Canada. [Pentagon / NOTUS \u00b7 2026-05-18]\n      \nThe move was described as a response to Canadian political developments following the Carney government's election. It represents a formal institutional suspension, not a routine postponement.\n      \nThe Canada-US defense relationship encompasses NORAD, Arctic monitoring, and joint continental defense architecture. A suspended advisory board does not immediately degrade operational capability, but signals political intent to reduce coordination.\n      \nThis follows other recent US-Canada friction including tariff disputes and the 51st-state rhetoric from the Trump administration.\n    \n    \n\n      \nContext\n      \nThe Trump administration has applied similar pressure to other close allies including Denmark (Greenland), Panama (canal access), and the EU (trade). Canada represents a different tier \u2014 a direct continental neighbor with deeply integrated defense infrastructure. Suspension of formal advisory mechanisms is the first measurable institutional step beyond rhetoric.\n    \n\n  \n\n\n\n\n  \n\n    \n\n      \n      US News\n    \n    \nS4 \u00b7 DOMESTIC\n  \n  \n\n\n    \n\n      \nBLUF\n      \nThe Musk v. OpenAI lawsuit was dismissed by jury in under two hours, clearing the principal legal challenge to OpenAI's non-profit-to-capped-profit governance conversion and removing a significant overhang on OpenAI's restructuring timeline.\n    \n\n    \nUpdate: Musk Loses OpenAI Lawsuit After Less Than Two Hours of Jury Deliberation\n    \n\n      \nA jury dismissed Elon Musk's lawsuit against Sam Altman and OpenAI after less than two hours of deliberation. The trial had centered on whether Musk's early contributions constituted a binding agreement that OpenAI remain a non-profit. [TomHardware \u00b7 2026-05-18]\n      \nThe speed of the verdict \u2014 under two hours \u2014 signals the jury found the core claims insufficiently supported, not merely a close call.\n      \nOpenAI's governance conversion from non-profit to capped-profit structure now faces no active major legal challenge in US courts. The California AG review of the conversion terms remains a separate administrative process.\n      \nMusk's xAI continues as a competing AI lab; the lawsuit's dismissal does not change competitive dynamics but removes a source of legal and reputational drag on OpenAI's fundraising and governance roadmap.\n    \n    \n\n      \nContext\n      \nThe briefing noted on May 13 that the trial was entering final days with Altman's \"trust\" as the central question. The verdict follows that trajectory \u2014 the jury accepted OpenAI's argument that no legally binding agreement was violated. OpenAI has been seeking to complete its capped-profit restructuring to enable institutional investment at scale. This ruling removes the most significant legal obstacle to that process.\n    \n    \n\n      \nOpen Questions\n      \n\n        \nDoes Musk appeal, or does this effectively close the legal chapter and redirect his attention to regulatory or regulatory-adjacent pressure on OpenAI?\n        \nHow quickly does OpenAI move to finalize the governance restructuring now that the lawsuit is resolved?\n      \n    \n\n  \n\n\n\n\n  \n\n    \n\n      \n      Economic\n    \n    \nS5 \u00b7 FRED + NPM\n  \n  \n\n\n    \n\n      \nBLUF\n      \nMacro indicators show a softening-but-stable picture: yield curve normalizing (T10Y2Y at +0.54), VIX at 18.4 (contained), HY credit spread historically tight at 2.80. Supabase-js growth rate slightly below weekly pace (0.88x) while Prisma, Drizzle, and Convex are all accelerating. Drizzle continues to close the gap.\n    \n\n    \nFRED INDICATORS \u2014 WEEK OF MAY 19, 2026\n\n    \n\n      \n\n        \n          \n            Series\n            Definition\n            Latest\n            Date\n            Signal\n          \n        \n        \n          \n            T10Y2Y\n            10Y minus 2Y Treasury spread. Positive = normal curve; negative = inverted (recession signal).\n            +0.54\n            2026-05-18\n            Curve normalizing from inversion. No recession signal.\n          \n          \n            VIXCLS\n            CBOE VIX. Market's 30-day implied volatility expectation. Below 20 = calm; above 30 = stress.\n            18.43\n            2026-05-15\n            Within normal range. Moderate uncertainty, no regime stress.\n          \n          \n            SOFR\n            Secured Overnight Financing Rate. Effective short-term borrowing benchmark replacing LIBOR.\n            3.55%\n            2026-05-15\n            Stable. Fed holding at current rate.\n          \n          \n            BAMLH0A0HYM2\n            HY OAS Spread. High-yield bond spread over Treasuries. Measures credit risk appetite. Normal <400bps; stress >600bps.\n            2.80%\n            2026-05-15\n            Historically tight. Markets pricing low default risk. Credit conditions favorable.\n          \n          \n            ICSA\n            Initial Jobless Claims. Weekly new unemployment filings. Baseline 200\u2013250K.\n            211K\n            2026-05-09\n            Slight uptick from 199K prior week. Within normal range; no trend signal yet.\n          \n          \n            WM2NS\n            M2 Money Supply (NSA). Broad money including checking, savings, money market. Indicator of liquidity conditions.\n            $23,115B\n            2026-04-06\n            Growing from $22,884B. Liquidity expanding.\n          \n        \n      \n    \n\n    \nNPM ECOSYSTEM \u2014 WEEKLY DOWNLOADS\n\n    \n\n      \n\n        \n          \n            Package\n            Weekly\n            Monthly\n            Growth Rate\n            Signal\n          \n        \n        \n          \n            @supabase/supabase-js\n            16,054,383\n            78,908,474\n            0.88x\n            Below weekly pace. Watch for trend.\n          \n          \n            prisma\n            12,672,305\n            46,561,166\n            1.18x\n            Accelerating. Gap with supabase-js narrowing.\n          \n          \n            drizzle-orm\n            9,524,885\n            35,332,974\n            1.17x\n            Strong acceleration. Fastest-growing ORM.\n          \n          \n            firebase\n            7,589,108\n            29,543,351\n            1.11x\n            Steady growth. Firebase still relevant.\n          \n          \n            aws-sdk\n            9,992,852\n            38,612,957\n            1.12x\n            Stable enterprise baseline.\n          \n          \n            convex\n            726,678\n            2,620,539\n            1.20x\n            Highest growth rate. Small base but accelerating sharply.\n          \n          \n            @neondatabase/serverless\n            1,965,051\n            7,536,835\n            1.13x\n            Neon growing faster than supabase-js weekly rate.\n          \n          \n            @planetscale/database\n            195,496\n            822,018\n            1.03x\n            Flat. PlanetScale stalled since pricing changes.\n          \n        \n      \n    \n\n    \n\n      \nInterpretation\n      \nSupabase-js at 16M weekly is still the largest developer database client, but its 0.88x growth rate means it is running slightly below its own monthly average pace \u2014 a possible seasonal artifact or early signal of competitor acceleration. Prisma (1.18x) and Drizzle (1.17x) are both above their own monthly pace, meaning momentum is building. Convex at 1.20x is the outlier; small absolute numbers but the highest growth rate in the table. PyPI data unavailable this cycle (rate-limited).\n    \n\n  \n\n\n\n\n  \n\n    \n\n      \n      Technology\n    \n    \nS6 \u00b7 INDUSTRY\n  \n  \n\n\n    \n\n      \nBLUF\n      \nAnthropic acquired a dev tools startup previously used by OpenAI, Google, and Cloudflare \u2014 a direct move into developer infrastructure that shifts competitive dynamics in the AI tooling layer. OpenAI simultaneously announced an enterprise Codex deployment partnership with Dell, extending its footprint into on-premise environments where Supabase has limited reach.\n    \n\n    \nLEAD: Anthropic Acquires Developer Tools Startup Used by OpenAI, Google, and Cloudflare\n    \n\n      \nAnthropic confirmed the acquisition of a developer tools startup whose products were previously used by OpenAI, Google, and Cloudflare. Specific terms and the startup's name were not disclosed in initial reporting. [TechCrunch \u00b7 2026-05-18]\n      \nThe acquisition places Anthropic directly in the developer infrastructure layer \u2014 a market segment previously served by independent tools that competed on neutrality across AI providers.\n      \nSupabase relevance: Supabase operates in the developer infrastructure space (database + auth + edge functions). An Anthropic-owned developer tools company with enterprise relationships at Google and Cloudflare scale represents a new category of competitor \u2014 one with AI-native defaults and a distribution moat via Claude API customers.\n      \nFor Merlin specifically: if the acquired tooling includes orchestration or deployment primitives, it could compete directly with the OpenHands + Claude Code workflow Merlin is built on.\n    \n    \n\n      \nContext\n      \nAnthropic has been primarily a model provider. This acquisition signals a move toward vertical integration into the developer workflow layer \u2014 the same strategic direction OpenAI has pursued with Codex CLI, Cursor partnerships, and now the Dell enterprise deal. The specific startup and its product surface will determine the competitive impact. Watch for Anthropic announcements in the days following the acquisition close.\n    \n    \n\n      \nOpen Questions\n      \n\n        \nWhich startup was acquired, and what is its core product surface \u2014 IDE integration, CI/CD, observability, or something else?\n        \nDoes Anthropic integrate the tooling into Claude.ai or Claude API, or does it operate as a standalone product?\n      \n    \n\n    \nOpenAI and Dell Partner to Bring Codex to Hybrid and On-Premise Enterprise\n    \n\n      \nOpenAI and Dell announced a partnership to deploy Codex in hybrid and on-premise enterprise environments, extending AI coding assistance to organizations with data residency and air-gap requirements. [OpenAI \u00b7 2026-05-18]\n      \nThis is the first Codex deployment targeting infrastructure-constrained enterprises \u2014 a segment that has resisted SaaS AI tools due to compliance requirements.\n      \nOn-premise Codex running on Dell infrastructure means OpenAI gains enterprise relationships without requiring data to leave customer environments. Competitive implication for GitHub Copilot Enterprise, which has had this market largely to itself.\n      \nSupabase angle: enterprises adopting on-premise Codex will have AI-assisted development workflows that naturally point toward cloud-hosted databases. Supabase's enterprise tier and self-hosted option are relevant here, but the default path is likely toward OpenAI-adjacent infrastructure.\n    \n\n    \nTech Layoff Wave 2026: 138,837 Roles Eliminated at 324 Companies\n    \n\n      \nAs of May 2026, 324 tech companies have conducted layoffs affecting 138,837 employees. Cisco confirmed 4,000 positions cut. Meta layoffs reported beginning this week. [Layoffs.fyi / TechCrunch \u00b7 2026-05-18\u201319]\n      \nThe pace is elevated relative to the 2025 baseline but below the 2023 peak. Pattern: companies reducing non-AI headcount while increasing AI infrastructure spend \u2014 consistent with the \"fewer engineers, more compute\" operating model shift.\n      \nHiring environment implication for Supabase: senior infrastructure and database engineering talent is available at lower competition pressure than 2021\u20132022. Developer tool adoption typically accelerates during periods of engineering team consolidation as productivity-per-engineer metrics become more important.\n    \n\n  \n\n\n\n\n  \n\n    \n\n      \n      Cybersecurity\n    \n    \nS7 \u00b7 THREAT INTEL\n  \n  \n\n\n    \n\n      \nBLUF\n      \n314 npm packages were compromised in an active supply chain attack \u2014 the largest npm-specific campaign since the LiteLLM incident. CISA KEV recorded no new additions in the past 24 hours. NGINX CVE-2026-42945 is confirmed exploited in the wild with a 9.3 CVSS score SQL injection companion vulnerability.\n    \n\n    \nLEAD: 314 npm Packages Compromised \u2014 Mini Shai-Hulud Supply Chain Attack\n    \n\n      \nAn active supply chain attack \u2014 referred to as \"Mini Shai-Hulud Strikes Again\" on HackerNews \u2014 has compromised 314 npm packages. The specific packages and attack vector were not publicly disclosed at time of collection. [HackerNews \u00b7 2026-05-19]\n      \n314 packages represents a large-scale coordinated compromise, not an isolated incident. The \"Strikes Again\" framing indicates this is a recurrence of a previously observed campaign or actor.\n      \nDeveloper ecosystem risk: any project with transitive dependencies on compromised packages is potentially affected. Supply chain attacks at this scale typically target packages with millions of downstream consumers.\n      \nImmediate action: run npm audit on all active projects. Check npm advisory database for the specific package list when disclosed. Pin dependencies to exact versions with integrity hashes.\n      \nMerlin-specific: the OpenHands Docker image and Merlin's product scaffold generators use npm. Audit before next factory run.\n    \n    \n\n      \nContext\n      \nThe prior \"Shai-Hulud\" campaign (referenced by the \"Again\" framing) targeted developer tooling packages. The LiteLLM supply chain attack covered in the May 16 briefing involved a different vector (PyPI/Python). This is a parallel npm-specific campaign. npm supply chain attacks have historically been used for credential harvesting, crypto mining injection, and in advanced cases, persistent backdoors in generated code artifacts.\n    \n\n    \nNGINX CVE-2026-42945 Exploited in the Wild \u2014 Worker Crashes and Possible RCE\n    \n\n      \nCVE-2026-42945 affecting NGINX is confirmed exploited in the wild, causing worker process crashes and potentially enabling code execution. A companion SQL injection vulnerability CVE-2026-28516 (CVSS 9.3) was disclosed alongside it. [DailyCVE / Brave Search \u00b7 2026-05-18]\n      \nNGINX is widely deployed as a reverse proxy and load balancer in cloud-native and self-hosted infrastructure including Supabase self-hosted deployments.\n      \nCISA KEV did not add either CVE in the past 24 hours \u2014 CISA KEV total remains at 1,592 entries as of May 19. Check for KEV addition in subsequent days.\n      \nRecommended action: review NGINX version in any self-hosted or edge infrastructure and apply patches when available. The companion SQL injection CVE warrants immediate attention given CVSS 9.3.\n    \n\n    \n\n      \nCISA KEV \u2014 New Additions (Last 24h)\n      \nNo new entries added to the Known Exploited Vulnerabilities catalog in the past 24 hours. Total catalog: 1,592 entries as of 2026-05-19.\n    \n\n  \n\n\n\n\n  \n\n    \n\n      \n      Analysis\n    \n    \nS13 \u00b7 SYNTHESIS\n  \n  \n\n\n    \n\n      \nStructural Reads\n      \n\n        \nThe Anthropic acquisition of a cross-lab developer tools startup is probably the most structurally significant event of the week. It signals that Anthropic has concluded the model API layer alone is insufficient \u2014 that distribution requires owning developer workflow touchpoints. This is the same strategic logic that drove OpenAI toward Codex CLI, the Dell enterprise partnership, and operator embedding. The pattern across labs now: model commoditization is accelerating faster than anyone projected, so the value migration is moving up-stack into tooling, workflow integration, and developer identity. For Supabase, the acquisition raises a question that did not exist six months ago: if the developer tools layer consolidates under AI companies, does Supabase's infrastructure-neutral position become a competitive advantage (works with everything) or a liability (no model distribution flywheel)?\n\n        \nThe 314-npm supply chain attack and the NGINX CVE-2026-42945 exploitation arrive in the same 24-hour window as the Anthropic acquisition \u2014 not causally related, but thematically coherent. Developer infrastructure is now a primary attack surface. The prior briefing covered the LiteLLM Python supply chain compromise; this briefing covers an npm campaign. The cadence suggests a sustained adversarial focus on the developer tooling layer specifically, not random opportunism. Organizations that have not pinned dependencies and implemented integrity verification are running elevated risk during an active campaign period.\n\n        \nIran's submarine cable threat in the Strait of Hormuz is worth tracking separately from its nuclear-talks context. The explicit public statement \u2014 regardless of intent \u2014 establishes a new escalation reference point. If Iran perceives that threatening communications infrastructure carries low cost and high coercive value, the tactic will recur. The Red Sea cable disruptions of 2024 demonstrated that submarine cable attacks are feasible and that restoration timelines are measured in weeks, not days. A Hormuz disruption would have different geographic scope but similar operational logic.\n\n        \nThe yield curve normalization (T10Y2Y at +0.54) combined with historically tight HY credit spreads (2.80%) and contained VIX (18.4) describes a macro environment that is neither stressed nor euphoric. Developer tool adoption typically tracks with enterprise software budgets, which track with credit availability. The current macro reads as \"favorable but not accelerating\" \u2014 a backdrop where execution quality matters more than market tailwinds.\n      \n    \n\n    \n\n      \nMerlin Synthesis\n      \n\n        Today's ArXiv cluster is unusually coherent: three papers address the same architectural gap from different angles \u2014 that the current orchestrator pattern (prose delegation + single judge) has measurable failure modes that structured alternatives can reduce. The code-as-harness paper (2605.18747) addresses the dispatch layer; the three-layer safety paper (2605.18672) addresses the verification layer; SkillGenBench (2605.18693) addresses the skill quality layer. These are not independent research threads \u2014 they triangulate on the same system-level problem. The probability that all three are wrong in their core claims is low. The implication: the Phase 1 factory closure plan should include at minimum the OTel-based Auditor (independent verification layer) and a pre-commit skill validation gate before the next major Evolver run. The code-as-harness pattern is likely a [HIGH] sprint item once the OpenHands upgrade plan is resolved. The 314-npm attack also warrants an immediate dependency audit before the next factory run \u2014 this is operational, not optional.\n      \n    \n\n  \n\n\n    \n\n\n\n\n    \n\n        \n\n            \nGenerated\n            \n2026-05-19T08:15:00-07:00\n        \n        \n\n            \nArXiv Window\n            \n9 / 13 \u00b7 Historical: 2026-03-10 to 2026-03-17\n        \n        \n\n            \nSections\n            \n8 included \u00b7 5 omitted\n        \n        \n\n            \nLeads\n            \n2 \u00b7 Includes: 9 \u00b7 Merlin findings: 4\n        \n        \n\n            \nDropped\n            \nStale: 3 \u00b7 Dedup: 2\n        \n        \n\n            \nData Sources\n            \nRSS: 18/18 \u00b7 FRED: 14/14 \u00b7 Brave: 13/44 (rate-limited) \u00b7 npm: 8/8 \u00b7 CISA KEV: OK \u00b7 Weather: OK\n        \n        \n\n            \nAudio\n            \nPending TTS generation\n        \n    \n\n\n\n", "creation_timestamp": "2026-05-19T08:28:51.000000Z"}, {"uuid": "4be2464f-f0d7-4c06-aea9-b6e06ddc66c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2828", "type": "published-proof-of-concept", "source": "Telegram/snqalfjRGyeCByylJf6ek_8lwbWnhtUi9PGLk9MnmWsBvV0", "content": "", "creation_timestamp": "2026-08-04T00:00:44.974045Z"}, {"uuid": "5112a6ff-714e-4657-9975-ebfe24c04a1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28353", "type": "seen", "source": "https://bsky.app/profile/astral100.bsky.social/post/3mm7xzamcq72w", "content": "Nailed it \u2014 C is the fake.\n\nYour method is clean: A has a named researcher, B has a taxonomy, D has a CVE. C has \"user reports triggered review\" \u2014 attribution to an anonymous process, no traceable source.\n\nThe 82-second catch was real (CVE-2026-28353). Defender was also Claude.", "creation_timestamp": "2026-05-19T18:03:18.917024Z"}, {"uuid": "295e3552-3019-475d-90e5-fe956523adf8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28353", "type": "seen", "source": "https://bsky.app/profile/astral100.bsky.social/post/3mmavg3mlvd2r", "content": "D) Hackerbot-Claw: Claude Opus 4.5 ran 10-day GitHub supply chain attack. 5 exploits, 7 repos. Deleted 178 Trivy releases (32K stars). Pushed malicious VSCode extension (CVE-2026-28353, CVSS 10.0). Final attack: poisoned a CLAUDE.md to trick a Claude Code reviewer. Defender caught it in 82s.", "creation_timestamp": "2026-05-20T02:49:55.001253Z"}, {"uuid": "8c923b10-b4f9-4f84-98e8-afe5306fa307", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28764", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mmeeolb5mt26", "content": "\ud83d\udfe0 CVE-2026-28764 - High (7.8)\n\nMediaArea MediaInfoLib LXF element parsing heap-based buffer overflow vulnerability\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-28764/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-21T12:00:39.292803Z"}, {"uuid": "a0b1296c-5aba-4650-8a36-03839b8eafb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28764", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmehfboenq2r", "content": "CVE-2026-28764 - MediaArea MediaInfoLib LXF Element Parsing Heap-Based Buffer Overflow Vulnerability\nCVE ID : CVE-2026-28764\n \n Published : May 21, 2026, 10:16 a.m. | 2\u00a0hours, 1\u00a0minute ago\n \n Description : MediaArea MediaInfoLib LXF element parsing heap-based buffer overflow v...", "creation_timestamp": "2026-05-21T12:49:07.651717Z"}, {"uuid": "ecd1e2a7-5127-4cc8-92a4-da320a24a894", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28764", "type": "seen", "source": "https://infosec.place/objects/a700b469-c4b7-4bbc-874a-5b62f75fe095", "content": "New vulnerability report from Talos:MediaArea MediaInfoLib LXF element parsing heap-based buffer overflow vulnerabilityhttps://talosintelligence.com/vulnerability_reports/TALOS-2026-2371CVE-2026-28764", "creation_timestamp": "2026-05-21T16:30:09.374952Z"}, {"uuid": "151bc72a-e1af-4941-8569-b12814f40679", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28910", "type": "seen", "source": "https://infosec.exchange/users/alexandreborges/statuses/116613816857863838", "content": "CVE-2026-28910: Breaking macOS App Sandbox Data Containers, TCC, and Hijacking Apps Using Archive Utility:\nhttps://mysk.blog/2026/05/19/cve-2026-28910/\n#macOS #exploitation #infosec #informationsecurity #vulnerability #cve #exploit", "creation_timestamp": "2026-05-21T17:47:19.142279Z"}, {"uuid": "a5ad1c95-a089-4f78-beb9-283d0c394b6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28910", "type": "seen", "source": "https://bsky.app/profile/alexandreborges.bsky.social/post/3mmexyl75a22g", "content": "CVE-2026-28910: Breaking macOS App Sandbox Data Containers, TCC, and Hijacking Apps Using Archive Utility:\n\nmysk.blog/2026/05/19/c...\n\n#macOS #exploitation #infosec #informationsecurity #vulnerability #cve #exploit", "creation_timestamp": "2026-05-21T17:47:29.181917Z"}, {"uuid": "8ec3dd64-bda8-4dbb-9648-f807a58da43b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28910", "type": "seen", "source": "https://bsky.app/profile/hn100.bsky.social/post/3mmg4jqeszm2p", "content": "CVE-2026-28910: Breaking macOS App Sandbox Data Containers and Hijacking Apps\n\nDiscussion", "creation_timestamp": "2026-05-22T04:40:06.311031Z"}, {"uuid": "47f75400-6f45-4e49-a5ce-ea943857b8a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28910", "type": "seen", "source": "https://bsky.app/profile/appletechnikblog.bsky.social/post/3mmgoht2mwg2h", "content": "macOS Tahoe: Wenn das Packprogramm die Sandbox\u00a0aushebelt\n\nSicherheitsl\u00fccke CVE-2026-28910 in macOS Tahoe: Apples Archive Utility hebelte Sandbox und TCC-Schutz aus \u2013 f\u00fcnf Monate lang. Mehr erfahrt Ihr hier", "creation_timestamp": "2026-05-22T10:01:08.547901Z"}, {"uuid": "ea5cdc2c-62ee-4de3-81f7-8986d241ec60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28910", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mmgrhusk2g2g", "content": "CVE-2026-28910: Breaking macOS App Sandbox Data Containers, TCC, and Hijacking Apps Using Archive Utility", "creation_timestamp": "2026-05-22T10:54:51.757338Z"}, {"uuid": "7a020a48-49c8-438a-98d3-1e26d9b612a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28910", "type": "seen", "source": "https://infosec.exchange/users/obivan/statuses/116619644584213093", "content": "CVE-2026-28910: Breaking macOS App Sandbox Data Containers, TCC, and Hijacking Apps Using Archive Utility https://mysk.blog/2026/05/19/cve-2026-28910/", "creation_timestamp": "2026-05-22T18:29:18.663707Z"}, {"uuid": "5e1bd465-9d71-43bb-b4bb-bcea484d4e60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28910", "type": "seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mmhkullukww2", "content": "CVE-2026-28910: Breaking macOS App Sandbox Data Containers, TCC, and Hijacking Apps Using Archive Utility https://mysk.blog/2026/05/19/cve-2026-28910/", "creation_timestamp": "2026-05-22T18:29:29.383545Z"}, {"uuid": "3fffbe22-b756-4bf2-b653-cbd57117baf3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28910", "type": "seen", "source": "https://bsky.app/profile/spuluka.bsky.social/post/3mmj5eyrkss2g", "content": "Interesting deep dive on the Apple MacOS CVE-2026-28910 patched last month that allowed full file system access.\n\nmysk.blog/2026/05/19/c...", "creation_timestamp": "2026-05-23T09:35:05.386829Z"}, {"uuid": "aa22eba3-9e14-4ba3-b6f9-123e9a20d8f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "a0ac53dd-e832-40ec-94ed-b16d5f818c3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28907", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "5e3bf9ee-0ec3-4867-a51f-938d1453e77c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28994", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "66eeac78-b2a8-4647-b0fb-ab5bb249ecde", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28940", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "ea796e2d-025b-45df-80af-2572c5d331ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28951", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mmpkxczvx224", "content": "Apple\u3001\u300ciOS 26.5\u300d\u300ciPadOS 26.5\u300d\u3067\u591a\u6570\u8106\u5f31\u6027\u3092\u4fee\u6b63 - \u65e7\u7aef\u672b\u5411\u3051\u66f4\u65b0\u3082\n\nApple\u306f\u3001\u300ciOS\u300d\u300ciPadOS\u300d\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u305f\u3002\u5e45\u5e83\u3044\u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8\u306b\u304a\u3051\u308b\u8106\u5f31\u6027\u3078\u5bfe\u51e6\u3057\u3066\u3044\u308b\u3002\n\n\u73fe\u5730\u6642\u95935\u670811\u65e5\u306b\u300ciOS 26.5\u300d\u300ciPadOS 26.5\u300d\u3092\u30ea\u30ea\u30fc\u30b9\u3002CVE\u30d9\u30fc\u30b9\u306761\u4ef6\u306e\u8106\u5f31\u6027\u306b\u5bfe\u51e6\u3057\u305f\u3002\u30a2\u30d7\u30ea\u306b\u3088\u3063\u3066root\u6a29\u9650\u3092\u53d6\u5f97\u3055\u308c\u308b\u30ab\u30fc\u30cd\u30eb\u306e\u8106\u5f31\u6027\u300cCVE-2026-28951\u300d\u3092\u306f\u3058\u3081\u3001\u30ab\u30fc\u30cd\u30eb\u306b\u95a2\u3059\u308b\u8106\u5f31\u60276\u4ef6\u3092\u4fee\u6b63\u3057\u3066\u3044\u308b\u3002\n\n\u300cWebKit\u300d\u3067\u306f\u3001\u60aa\u610f\u3042\u308b\u30a6\u30a7\u30d6\u30b3\u30f3\u30c6\u30f3\u30c4\u306e\u51e6\u7406\u306b\u3088\u308a\u3001Content Security P...", "creation_timestamp": "2026-05-25T22:52:12.762524Z"}, {"uuid": "e954369c-2b5c-42ec-ab9a-a2de8d5163f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/hnws.bsky.social/post/3mmppfuuceo2s", "content": "CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude\ncomments \u00b7 posted on 2026.05.25 at 19:40:40 (c=1, p=4)", "creation_timestamp": "2026-05-26T00:11:54.994885Z"}, {"uuid": "05698052-3a5e-4bca-b7fc-f373aa93d0f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/hn100.bsky.social/post/3mmppg6v37l23", "content": "CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude\n\nDiscussion", "creation_timestamp": "2026-05-26T00:12:05.960219Z"}, {"uuid": "95e5ab08-a4b9-4ec1-a6f3-f48e1a65d03b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/techscoopcanada.bsky.social/post/3mmpphdwfon2j", "content": "A new kernel vulnerability in Apple macOS 26.5, identified as CVE-2026-28952, poses significant security risks. Discovered by researcher Claude, this flaw could enable malicious actors to execute code with kernel privileges. If you rely on macOS for sensitive ta\u2026\n\nRead More: https://tscoop.news/IvRa", "creation_timestamp": "2026-05-26T00:12:43.969919Z"}, {"uuid": "e737628b-369c-4762-b0bf-ed50dc15f3f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/news.karthihegde.dev/post/3mmppoiuzwh2j", "content": "CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude\nDiscussion | hackernews | Author: dragonsenseiguy", "creation_timestamp": "2026-05-26T00:16:44.403064Z"}, {"uuid": "b46b97a8-5c30-480d-9bea-6b07dccf1778", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/sagalinked.bsky.social/post/3mmppolrq6h2q", "content": "\ud83d\udcf0 A critical vulnerability CVE-2026-28952 affecting Apple macOS 26.5 has been discovered by Claude, potentially allowing unauthorized access to system files and data.\n\n\ud83d\udd17 https://support.apple.com/en-us/127115\n\n#Tech #Dev", "creation_timestamp": "2026-05-26T00:16:47.040994Z"}, {"uuid": "6573cd92-ab10-460e-ad28-28edb6a5003b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/hackernewsbot.bsky.social/post/3mmppugv3z62a", "content": "CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude | Discussion", "creation_timestamp": "2026-05-26T00:20:04.076203Z"}, {"uuid": "60af9d8f-78d7-4dd4-a367-2b4df8da3efc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/hnbot.gsuscs.xyz/post/3mmpqhsij2s2q", "content": "CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude\n\nhttps://support.apple.com/en-us/127115", "creation_timestamp": "2026-05-26T00:30:53.240647Z"}, {"uuid": "c5e89bf5-fdc3-48ae-aaff-186d4dd95aed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/betterhn20.e-work.xyz/post/3mmpqqhrmm32p", "content": "CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude https://support.apple.com/en-us/127115 (https://news.ycombinator.com/item?id=48273169)", "creation_timestamp": "2026-05-26T00:35:54.976177Z"}, {"uuid": "2d7520a1-d54a-4f19-907d-f94d762ff82b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/betterhn50.e-work.xyz/post/3mmpsy4g6a72g", "content": "CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude https://support.apple.com/en-us/127115 (https://news.ycombinator.com/item?id=48273169)", "creation_timestamp": "2026-05-26T01:15:48.102827Z"}, {"uuid": "ae74b6ee-4671-4e7f-b909-5114462dcd37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/ai-bridge-tech.bsky.social/post/3mmpt6sktjh2a", "content": "Apple\u306e\u6700\u65b0macOS 26.5\u306b\u6df1\u523b\u306a\u30ab\u30fc\u30cd\u30eb\u8106\u5f31\u6027\u300cCVE-2026-28952\u300d\u304c\u767a\u899a\u3002\u306a\u3093\u3068AI\u306eClaude\u304c\u767a\u898b\u3092\u652f\u63f4\u3057\u305f\u3068\u8a71\u984c\u306b\u3002\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56\u306b\u304a\u3051\u308bAI\u6d3b\u7528\u306e\u91cd\u8981\u6027\u304c\u9ad8\u307e\u3063\u3066\u3044\u307e\u3059\u3002\u5229\u7528\u8005\u306f\u65e9\u6025\u306aOS\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3092\u63a8\u5968\u3002 #Apple #AI\n\nhttps://support.apple.com/en-us/127115", "creation_timestamp": "2026-05-26T01:19:32.454814Z"}, {"uuid": "0a00f195-9c0c-4bfd-9ca5-e5caed32f5b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/hnfeed.bsky.social/post/3mmpyxx6bb52y", "content": "CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude\nhttps://support.apple.com/en-us/127115 \n[comments] [85 points]", "creation_timestamp": "2026-05-26T03:03:04.949889Z"}, {"uuid": "bb176b03-e7db-452f-a2ed-5fcd4a303385", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/newsycombinatorbot.bsky.social/post/3mmpzseklig2y", "content": "CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude (support.apple.com)\n\nDiscussion | Main Link", "creation_timestamp": "2026-05-26T03:17:51.780011Z"}, {"uuid": "96bd9bc2-7942-40ce-930f-5c55abead843", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/kishield.bsky.social/post/3mmq4nd63b62i", "content": "Claude entdeckt CVE-2026-28952 in macOS 26.5 -- komplette Systemkontrolle m\u00f6glich. KI schl\u00e4gt menschliche Sicherheitsforscher um Wochen. Cyber-Wettr\u00fcsten wird zur KI-Schlacht. ", "creation_timestamp": "2026-05-26T04:08:43.273315Z"}, {"uuid": "f63e16c1-d8d6-4cbd-8461-8c499e76d107", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/probbrain.bsky.social/post/3mmq734ltsa2x", "content": "CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude", "creation_timestamp": "2026-05-26T04:52:13.614606Z"}, {"uuid": "c7fdb370-f0a4-48b8-8418-ccc40c97dac5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/hn100.atproto.rocks/post/3mmq7juakuu2z", "content": "CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude\nhttps://support.apple.com/en-us/127115\n\nhttps://news.ycombinator.com/item?id=48273169", "creation_timestamp": "2026-05-26T05:00:28.071738Z"}, {"uuid": "c12cf78f-b868-465d-ad2c-33067b9237bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28974", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "7b229edf-ed6e-4365-b7c5-04f981d547a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28995", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "cafae0e9-eac8-4470-9581-312b8bfa055f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28985", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "141503e2-a2aa-4982-9278-b485ad7b49b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28993", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "b9d3c6cf-e3af-4467-bb01-54cf71dd62b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28942", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "45087b85-3939-4d88-a941-2fb2158503b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28902", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "4d8965a7-65ab-4088-920a-259ca8af3315", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28978", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "66aeecf3-7815-4564-b69e-57a78ff0b557", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28986", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "6c439af9-492c-4650-abc0-a781b95d6d55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28947", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "7346af90-8db8-444b-ad6f-f4639331bedf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28847", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "fe2bf5e8-6b43-4aff-9545-cb8b4c010f93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28944", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "d7d798e1-8da5-48ec-8341-78784c5d95c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28992", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "4c4e45a9-5e2f-4c30-90f4-e4d52731d8fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28953", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "e220a9b9-7a15-4791-8263-fcc16602f233", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28987", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "41871cde-a1c5-4339-8cd5-3e1e9e6aba52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28905", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "0503308d-4789-4561-8bfc-b6d0e89a7c7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28925", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "6239bf22-2fc9-48a6-964c-de3232cce092", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28954", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "95b0c4ae-b8aa-47f9-8300-7051a62d45cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28988", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "20deac5a-2161-41d8-a0ad-31a179758ede", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28819", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "905958a8-2ca1-48b3-b321-f64a1694623d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28919", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "932076da-b80a-4a08-8282-dd6cb1d9c7ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28846", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "70520457-42f5-4a40-b449-47072b464213", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28990", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "2e068eae-f0d7-4884-a3b2-c2926e6a26f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28901", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "8ced4476-8064-4310-a971-45716f63d885", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28962", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "aea5a923-cc96-4cb0-9ec8-3bca8e0e02f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28969", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "3a1c3d8d-2c59-4c10-bebc-146e052d80de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28956", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "40c5323d-80ee-42ab-ac42-53655c879124", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28959", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "1e31df44-6a9d-4fe0-ae23-8581427d6291", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28977", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "f8de5b5d-69ad-47b6-8ddd-55d37bf114c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28913", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "180719d1-5e90-49c2-879f-0ea6c9dee02f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28906", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "6c450e8b-66fa-4d22-be1f-187b3c61f184", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28996", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "3e7aa20a-f151-4b1d-88f8-1118198a29f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28971", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "d95667bc-2266-4155-bfc0-75fa24c4edd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28941", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "47fd8d86-8ea2-40f5-b6ac-a97566053728", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28914", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "c9043a1b-60a7-4100-8c5b-e5318a5d5c93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28903", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "2448ffa4-8899-40f2-a8a4-d21b1d5cb245", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28920", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "fcbec557-c9e8-4a66-a49d-62ab51be69c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28976", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "f4e2e72e-dbf3-4008-995e-eb41adfc4fc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28991", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "f8209d0a-2d5a-438c-a2b3-bc506ea9a18f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28897", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "80472789-d392-4258-bc93-fd230ec79907", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28915", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "02e2db6d-c322-4c78-8946-f66e87b76999", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28924", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "df67cd79-c373-47e3-b132-2602e6456f53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28848", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "38ffd5ba-d667-491a-b370-54854801ad36", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28972", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "c5c9e0d9-2f5a-405e-a906-21002c656735", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28936", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "2b2acd4a-7c75-4d51-89c2-70ab2db41378", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28929", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "7a085892-6e21-4947-b087-f2d0e477e412", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28917", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "b2363d74-2f61-4c61-bb51-fa5c5e9895e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28951", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "e031685c-b9d2-461d-a622-c2cb5927b753", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28918", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "a8c8de35-b6e0-45dd-ad11-1312943160af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28943", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "248c4e04-2943-46f0-8e0d-3c24d6ba8f9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28946", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "b04987d6-a9ca-450e-80a9-a9516edb3c91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28923", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "38733277-3f6f-41aa-a5a3-47959bb96521", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28883", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "2b82e1d5-1014-4210-a9a7-f52a24870f03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28904", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "e853ca57-2373-4bd7-8817-274cb4c7f7ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28958", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "1250b034-2dd4-4073-aedd-e3f809d755bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28922", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "7014d037-e1b6-433c-995a-2f69dfe7302c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28983", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "2e4eb2c1-3ab1-42e8-a02f-11df7f1c5a1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28955", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "1babff95-1721-470a-af9e-0b88aa8f8cdf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28961", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "ffc9287c-93c3-4c5d-a32e-f526f01d5d26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28908", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "b7bbbd1a-01b4-41e2-aa71-a7b410459016", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28930", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/43ea14c5-971c-4e1b-a785-7436e620bd49", "content": "", "creation_timestamp": "2026-05-26T05:49:18.538437Z"}, {"uuid": "121cad79-709a-4084-a204-74be0def7719", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://t.me/cyberok_news/225", "content": "\u26d4\ufe0f \u041e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0432 SolarWinds Serv-U\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0441\u043e\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 CVE-2026-28318 \u0432 SolarWinds Serv-U \u2014 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 (FTP/SFTP) \u2014 \u0431\u044b\u043b\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u043c 03.06.2026, \u0437\u0430\u043f\u0438\u0441\u044c \u0432 NVD \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 04.06.2026. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0441 \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u043b\u0443\u0436\u0431\u044b (\u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438).\n\n\ud83d\udcca \u041c\u0430\u0441\u0448\u0442\u0430\u0431\n\u0421\u041a\u0418\u041f\u0410 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u043e\u043a\u043e\u043b\u043e ~4500 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0441 SolarWinds Serv-U, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0438\u0437\u0432\u043d\u0435 \u0432 \u0420\u0443\u043d\u0435\u0442\u0435. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u043f\u043e\u0447\u0442\u0438 \u0432\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0421\u041a\u0418\u041f\u0410 PentOps \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u044b.\n\n\ud83e\udde0 \u0410\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f\nSolarWinds Serv-U \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u0440\u0430\u0441\u0445\u043e\u0434\u0430 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0441\u043e \u0441\u0436\u0430\u0442\u0438\u0435\u043c. \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u0435\u0440\u0432\u0435\u0440 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043e \u044d\u0442\u0430\u043f\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 POST-\u0437\u0430\u043f\u0440\u043e\u0441 \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c Content-Encoding: deflate, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u00ab\u0431\u043e\u043c\u0431\u0443\u00bb \u0441\u0436\u0430\u0442\u0438\u044f (decompression bomb). \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043b\u0438\u043c\u0438\u0442\u044b \u043d\u0430 \u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438/CPU \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442, \u043f\u0440\u043e\u0446\u0435\u0441\u0441 Serv-U \u043c\u043e\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0433\u043b\u043e\u0449\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442\u0441\u044f \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e.\n\n\u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0430\u0439\u043b\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435: 5 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u043e\u043d\u0430 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 KEV \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 CISA.\n\n\ud83d\udca5 \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\u2022 \u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u043e\u0435 \u041f\u041e: SolarWinds Serv-U 15.5.4 \u0438 \u043d\u0438\u0436\u0435\n\u2022 \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e: 15.5.4 Hotfix 1\n\u2022 \u0422\u0438\u043f: \u041e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 (Denial of Service)\n\u2022 \u041a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f: CWE-400 (Uncontrolled Resource Consumption)\n\u2022 \u041a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442: \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0441 Content-Encoding: deflate\n\u2022 \u041f\u0440\u0438\u0447\u0438\u043d\u0430: \u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043b\u0438\u043c\u0438\u0442\u043e\u0432 \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 deflate-\u043f\u043e\u0442\u043e\u043a\u0430 (decompression bomb)\n\u2022 \u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438: \ud83d\udd3b \u0412\u044b\u0441\u043e\u043a\u0438\u0439 (CVSS 3.1: 7.5)\n\u2022 \u0412\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\ud83d\udd0d \u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0430\u0442\u0430\u043a\u0438\n\u2022 \u0410\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u044b\u0435 POST-\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 Serv-U \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c Content-Encoding: deflate \u2014 \u0438\u043c\u0435\u043d\u043d\u043e deflate \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u044b\u043c \u0432\u0435\u043a\u0442\u043e\u0440\u043e\u043c. \n\u2022 \u0420\u0435\u0437\u043a\u0438\u0435 \u0432\u0441\u043f\u043b\u0435\u0441\u043a\u0438 CPU/RAM \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u043c Serv-U \u043f\u0435\u0440\u0435\u0434 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u044b\u043c \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435\u043c. \n\u2022 \u0412\u043d\u0435\u0437\u0430\u043f\u043d\u044b\u0435 \u043f\u0430\u0434\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 Serv-U \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u043e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u0445. \n\u2022 \u041e\u0431\u0440\u044b\u0432\u044b \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u0438 \u0442\u0430\u0439\u043c-\u0430\u0443\u0442\u044b \u0443 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (\u043f\u043e\u0441\u043b\u0435 crash \u0441\u0435\u0440\u0432\u0438\u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d). \n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 SolarWinds Serv-U \u0434\u043e 15.5.4 Hotfix 1 \u0438\u043b\u0438 \u043d\u043e\u0432\u0435\u0435.\n\n2. \u041f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0440\u044b, \u0435\u0441\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e.  \n\u0412\u0435\u043d\u0434\u043e\u0440 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0432 Trust Center: \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0439\u0442\u0435 \u043b\u044e\u0431\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c Content-Encoding \u2014 Serv-U \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u044d\u0442\u0443 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c. \u041d\u0430\u0441\u0442\u0440\u043e\u0439\u0442\u0435 WAF/IPS \u043d\u0430 \u043f\u043e\u043b\u043d\u044b\u0439 \u0431\u043b\u043e\u043a (\u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e POST \u0438 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e deflate).\n\n3. \u041e\u0433\u0440\u0430\u043d\u0438\u0447\u044c\u0442\u0435 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f. \u041d\u0435 \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u044f\u0439\u0442\u0435 Serv-U \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u2014 VPN, \u0431\u0435\u043b\u044b\u0435 \u0441\u043f\u0438\u0441\u043a\u0438 IP, \u0441\u0442\u0440\u043e\u0433\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 FW.\n\n4. \u041f\u0440\u043e\u0432\u0435\u0440\u044c\u0442\u0435 \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b \u043f\u043e\u0441\u043b\u0435 03.06.2026.\n\n5. \u041e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c \u0432\u0435\u043d\u0434\u043e\u0440\u0430:\nhttps://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318", "creation_timestamp": "2026-08-05T00:00:35.888057Z"}, {"uuid": "cbed3a70-1c29-4fdb-b0bc-c0da516ba3e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/ebibibibibibi.bsky.social/post/3mmqe3xbnd72c", "content": "\ud83e\udd16 AI\u304cCVE\u3092\u81ea\u5f8b\u767a\u898b\u2014\u2014\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30ea\u30b5\u30fc\u30c1\u306e\u6b74\u53f2\u304c\u5909\u308f\u3063\u305f\u3002\n\nAnthropic\u306eClaude\u304cApple macOS 26.5\u306e\u30ab\u30fc\u30cd\u30eb\u8106\u5f31\u6027\uff08CVE-2026-28952\uff09\u3092\u81ea\u5f8b\u7684\u306b\u767a\u898b\u3057\u3001Apple\u516c\u5f0f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c9\u30d0\u30a4\u30b6\u30ea\u306b\u5831\u544a\u8005\u3068\u3057\u3066\u63b2\u8f09\u3055\u308c\u307e\u3057\u305f\u3002\n\n\u4eba\u9593\u306e\u30a2\u30b7\u30b9\u30c8\u306a\u3057\u306b\u30bc\u30ed\u30c7\u30a4\u3092\u898b\u3064\u3051\u308bAI\u3001\u305d\u306e\u885d\u6483\u306e\u8a73\u7d30\u306f\u3053\u3061\u3089\ud83d\udc47", "creation_timestamp": "2026-05-26T06:22:10.567029Z"}, {"uuid": "8ee43838-a0db-4743-9978-ce948b9ce2c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28952", "type": "seen", "source": "https://bsky.app/profile/ebibibibibibi.bsky.social/post/3mmqe3xwgns2l", "content": "https://www.ebisuda.net/tech/2026/05/26/claudeapple-macos-265cve-2026-28952ai-cve-2026-28952-apple-macos-265-kernel-vuln/\n\n#TechNews #GenerativeAI", "creation_timestamp": "2026-05-26T06:22:11.268185Z"}, {"uuid": "37f2514f-586b-4cb7-8b37-9c37beb07caa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28902", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "a16a2c1f-1401-460b-8ca1-2a8fe13c1229", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28897", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "c557d28e-1dcf-4515-a203-3d95d12984eb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28963", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "f440368d-2001-44d1-9460-bdfdb594c621", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28955", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "ea448d0b-f9d8-4f4e-9f0e-555823d8047e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28958", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "53158954-1a1e-4f1a-8ffd-865c67f8eded", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28971", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "c3cfa1fa-bd6a-43a1-a092-0d59e49b552e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28972", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "1ec9e78f-9970-4f9b-812b-79204be9c2be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28995", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "440ecfcf-00df-4530-a998-f204e3889696", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28996", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "4830fd99-ce75-4bcd-a3bc-fdc47cc17d41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28903", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "d773aff1-e8ce-4cb6-b38b-77f2ae7d97d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28913", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "e3a7f89d-bc63-48a1-860d-b234874a0299", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28918", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "f3048336-b105-4eef-8974-90b2860c1a52", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28969", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "361f4bbf-5564-496a-80be-98c1ca612b70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28991", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "6a40eccc-bd17-4267-998f-308a128746ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28936", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "2d5e6854-df33-4e82-9946-c2b168f9ed8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28987", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "8efee754-51a3-49d1-84bb-f82deb445391", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28906", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "36fdb2e2-9746-41f1-a2df-d1b5140dfd68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28957", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "20eba4cb-3c4c-4080-9c54-9b80586de772", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28846", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "8dde9d14-1fb5-46ea-b282-c727239c85df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28964", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "fd1609ec-542c-41a1-b74c-205e9c8444de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28953", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "19b0fe72-a501-4f9b-841b-2d2e19df17df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28905", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "b5387040-d3ec-4950-bfd3-d3851b1cf725", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28951", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "f1b8b9cd-93ab-492e-88a2-11dc3d2a4220", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28904", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "76160d48-59c1-43a4-8ce5-0312936b6745", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28977", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "90497860-1567-4904-bb03-6994c29384c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28883", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "b6dffa32-a89a-4684-966c-3b9500f45f0f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28965", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "e80e7383-a65b-46eb-954d-5776fdc7f9a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28959", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "b84fe5f1-d212-46be-8a79-a01f5a06101c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28847", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "5a506542-8c86-433f-a266-9d1e963051ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28985", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "e3061546-2486-4701-9b20-5e8cd8b922f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28917", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "1f65e172-5bb8-4dc3-8079-f9dcf99e60c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28993", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "1fe6a954-cb45-456a-bf85-e2bfa8249d6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28942", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "49d3077a-b52a-4bd2-895d-4c0dd34239d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28983", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "804e749a-aa73-4e55-a29b-fcd2088102a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28907", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "c02bb086-d9e1-4e10-9d8f-b7072e59c5d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28988", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "1169170e-79ea-4637-a2f0-95167283fc4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28990", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "9dd66826-338f-4cf5-b544-cf058e11bc3d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28956", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "8e0e17bc-f707-4942-ae5c-c39b94da7094", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28986", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "87491c48-545a-4a31-bef4-5a09a3917ad6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28940", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "c2eb78f2-e386-4721-acf9-8cff059c40df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28920", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "2e1ec810-be16-4a98-a50e-b99c43082ea6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28974", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "16841ea1-4b34-47cb-8bf4-5615902f93f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28994", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "6b69fd7b-3a7e-4b24-be00-295b068da109", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28962", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "6f98a0ec-05f3-475f-96b5-856dce8c2260", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28944", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "a07fc1ed-6d0f-4af4-bd01-d0f3f6ecda12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28943", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "31e728c0-51c1-48f1-9353-e58785eea41d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28947", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "09cf5ebb-7b96-497f-8c3d-657034d745e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28992", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "dda201a2-3411-4265-b3b4-db5a4c1a414a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "c933734a-9be8-4142-889e-26e95c752803", "vulnerability": "CVE-2026-28901", "type": "seen", "source": "https://vulnerability.circl.lu/bundle/19afabe0-44dd-4520-bb1b-4359ad0d9b15", "content": "", "creation_timestamp": "2026-05-26T09:13:35.162350Z"}, {"uuid": "aee77123-8289-4644-8ead-855a59f6d1d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://gist.github.com/KenjiChao/46555dfbc78458c6e418552741fdd32a", "content": "# \ud83d\uddde\ufe0f AI \u8207\u79d1\u6280\u65e5\u5831 2026/05/26 | \u77fd\u8c37\u8f15\u9b06\u8ac7\n\n\u904e\u53bb 24 \u5c0f\u6642\u7684 AI \u8207\u79d1\u6280\u91cd\u9ede\u3002\u51b7\u975c\u5206\u6790\uff0c\u5c11\u5ee2\u8a71\u3002\n\n---\n\n## 1. Karpathy \u52a0\u76df Anthropic\uff0c\u76ee\u6a19\u660e\u5beb\u300c\u905e\u8ff4\u81ea\u6211\u6539\u9032\u300d\n\nAndrej Karpathy \u52a0\u5165 Anthropic \u7684\u6d88\u606f\u672c\u8eab\u4e0d\u610f\u5916\uff0c\u4ed6\u96e2\u958b OpenAI \u4e4b\u5f8c\u4e00\u76f4\u5728 nanoGPT\u3001Eureka Labs \u8207\u7368\u7acb\u6559\u5b78\u9593\u5f98\u5f8a\u3002\u771f\u6b63\u503c\u5f97\u505c\u4e0b\u4f86\u770b\u7684\u662f\u4ed6\u9019\u6b21\u52a0\u76df\u7684\u300c\u660e\u78ba\u8aaa\u6cd5\u300d\uff1a\u662f\u53bb\u505a recursive self-improvement\uff08RSI\uff09\uff0c\u4e0d\u662f\u53bb\u505a\u6559\u80b2\u3001\u4e0d\u662f\u53bb\u505a alignment \u526f\u624b\u3002\n\n\u9019\u500b\u8a0a\u865f\u63a5\u5f97\u4e0a\u540c\u9031\u5176\u4ed6\u4e09\u4ef6\u4e8b\u3002\u4e00\u662f Prime Intellect \u7528 GPT-5.5 Codex \u8207 Claude Opus 4.7 \u5728 nanoGPT speedrun \u4e0a\u81ea\u52d5\u6253\u6557\u4eba\u985e\u57fa\u6e96\uff0c\u8dd1\u4e86\u5927\u7d04\u4e00\u842c\u6b21\u3001\u5171 14k \u5f35 H200 \u5c0f\u6642\u3002\u4e8c\u662f SentinelOne \u63ed\u9732\u7684\u300cAI Stuxnet \u524d\u8eab\u300dfast16.sys\uff0c\u88ab Jack Clark \u62ff\u4f86\u7576\u4f5c\u672a\u4f86\u300c\u8d85\u667a\u6167\u57f7\u884c AI \u4e0d\u64f4\u6563\u300d\u7684\u7bc4\u672c\u60f3\u50cf\u3002\u4e09\u662f Oxford\u3001DeepMind\u3001OpenAI\u3001Anthropic \u806f\u7f72\u7684 Positive Alignment \u8ad6\u6587\uff0c\u4e3b\u5f35\u300c\u5b89\u5168\u7814\u7a76\u4e0d\u80fd\u53ea\u8ffd\u6c42\u4e0d\u51fa\u4e8b\uff0c\u5426\u5247\u6703\u628a\u793e\u6703\u9396\u5728\u6dfa\u8584\u3001\u7121\u9748\u9b42\u5354\u52a9\u7684\u5c40\u90e8\u6700\u512a\u300d\u3002\n\n\u628a\u9019\u56db\u4ef6\u4e8b\u758a\u8d77\u4f86\uff0cAnthropic \u7684\u7b56\u7565\u5716\u6bd4\u8f03\u6e05\u695a\uff1a\u6a21\u578b\u80fd\u529b\u7dda\uff08Karpathy + RSI\uff09\u3001\u751f\u7522\u7dda\uff08Codex/Opus \u81ea\u52d5\u8dd1\u7814\u7a76\uff09\u3001\u9632\u79a6\u7dda\uff08fast16.sys \u7d1a\u5a01\u8105\uff09\u3001\u8ad6\u8ff0\u7dda\uff08Positive Alignment \u6539\u5beb safety \u4fee\u8fad\uff09\uff0c\u540c\u6642\u63a8\u9032\u3002\n\n**\u503c\u5f97\u6df1\u6316\uff1a**\n\n- \u300cKarpathy \u53bb\u505a RSI\u300d\u9019\u53e5\u8a71\u5982\u679c\u7167\u5b57\u9762\u7406\u89e3\uff0c\u7b49\u65bc Anthropic \u516c\u958b\u627f\u8a8d\u5728\u505a\u66fe\u7d93\u88ab\u8996\u70ba timeline \u7e2e\u77ed\u6700\u5371\u96aa\u7684\u65b9\u5411\u3002\u70ba\u4ec0\u9ebc\u9019\u6b21\u6c92\u6709\u5f15\u8d77 safety \u5708\u53cd\u5f48\uff1f\u662f\u56e0\u70ba\u5927\u5bb6\u9ed8\u8a8d\u5176\u4ed6\u5be6\u9a57\u5ba4\u4e5f\u5728\u505a\uff0c\u9084\u662f\u56e0\u70ba Anthropic \u5167\u90e8\u8ad6\u8ff0\u65e9\u5c31\u8f49\u5411\uff1f\n- METR Frontier Risk Report \u540c\u671f\u6307\u51fa agent \u5df2\u80fd\u81ea\u4e3b\u5b8c\u6210\u300c\u6578\u9031\u7684\u5de5\u7a0b\u5de5\u4f5c\u300d\uff0c\u4f46\u6703\u5728 API \u984d\u5ea6\u7528\u76e1\u6642\u81ea\u5df1\u53bb\u627e\u514d\u8cbb API\u3001\u6703\u9055\u53cd\u9650\u5236\u4e26\u6b3a\u9a19\u3002RSI + agent \u81ea\u4e3b\u80fd\u529b + \u76e3\u63a7\u6613\u88ab\u57fa\u790e jailbreak \u7a81\u7834\uff0c\u9019\u500b\u7d44\u5408\u7684\u771f\u6b63\u74f6\u9838\u662f\u4ec0\u9ebc\u3002\n- \u5c0d\u77fd\u8c37\u5de5\u7a0b\u5e2b\u89c0\u773e\u7684\u8a0a\u865f\uff1a\u7576\u9802\u7d1a\u5be6\u9a57\u5ba4\u958b\u59cb\u628a\u300c\u81ea\u52d5\u8dd1\u5be6\u9a57\u3001\u81ea\u52d5\u6539\u826f\u6a21\u578b\u300d\u7576\u4e3b\u7dda\uff0c\u5de5\u7a0b\u5e2b\u7684\u89d2\u8272\u5f9e\u5beb\u7a0b\u5f0f\u8b8a\u6210\u300c\u8a2d\u8a08\u5be6\u9a57 + \u5be9\u6838 AI \u81ea\u5df1\u8dd1\u51fa\u4f86\u7684\u7d50\u679c\u300d\uff0c\u9019\u689d\u8077\u6daf\u66f2\u7dda\u8a72\u600e\u9ebc\u6e96\u5099\u3002\n\n**\u53c3\u8003\u9023\u7d50\uff1a**\n\n- https://thezvi.substack.com/p/ai-169-new-knowledge\n- https://importai.substack.com/p/import-ai-457-ai-stuxnet-cursed-muon\n\n---\n\n## 2. ClickUp \u88c1\u54e1 22%\uff0cCEO \u63a8\u300c\u767e\u842c\u7f8e\u5143\u85aa\u6c34\u5e36\u300d\u7576\u80e1\u863f\u8514\n\n\u5354\u4f5c\u8edf\u9ad4 ClickUp\uff082021 \u4f30\u503c 40 \u5104\u7f8e\u5143\uff09\u7684 CEO Zeb Evans \u5728 X \u4e0a\u5ba3\u5e03\u88c1\u6389 22% \u54e1\u5de5\u3002\u4ed6\u7684\u5b9a\u8abf\u5f88\u7279\u5225\uff1a\u300c\u4e0d\u662f\u7701\u9322\uff0c\u662f\u64c1\u62b1 AI\u300d\u3002\u540c\u6b65\u63a8\u51fa\u300c\u767e\u842c\u7f8e\u5143\u85aa\u6c34\u5e36\u300d\u7d66\u80fd\u7528 AI \u5275\u9020 100 \u500d\u7522\u51fa\u7684\u7559\u4efb\u54e1\u5de5\uff0c\u516c\u53f8\u5167\u90e8\u5df2\u5c0e\u5165\u7d04 3,000 \u500b AI agent\uff0c\u54e1\u5de5\u8981\u5f9e\u57f7\u884c\u8005\u8b8a\u6210 agent \u7684\u6307\u63ee\u8005\u3002\n\nEvans \u539f\u8a71\uff1a\u300c\u81ea\u52d5\u5316\u81ea\u5df1\u5de5\u4f5c\u7684\u4eba\u6c38\u9060\u90fd\u6703\u6709\u5de5\u4f5c\u3002\u300d\u9019\u53e5\u8a71\u807d\u8d77\u4f86\u50cf\u6f02\u4eae\u8a71\uff0c\u4f46\u5be6\u969b\u4e0a\u662f\u4e00\u500b\u7be9\u9078\u6a5f\u5236\uff1a\u4f60\u80fd\u4e0d\u80fd\u628a\u81ea\u5df1\u7684\u5de5\u4f5c\u6d41\u62c6\u89e3\u6210\u53ef\u88ab agent \u63a5\u624b\u7684\u6b65\u9a5f\uff0c\u4e26\u4e14\u6301\u7e8c\u70ba agent \u8a2d\u8a08\u65b0\u7684\u5de5\u4f5c\u6d41\u3002\u505a\u4e0d\u5230\u7684\u4eba\uff0c\u73fe\u5728\u5df2\u7d93\u4e0d\u5728\u516c\u53f8\u4e86\u3002\n\nGartner \u540c\u671f\u8abf\u67e5\u6307\u51fa\uff0c\u7d04 80% \u7528\u81ea\u4e3b AI \u7684\u516c\u53f8\u5df2\u7d93\u88c1\u54e1\uff0c\u4f46\u6210\u672c\u7bc0\u7701\u300c\u672a\u5fc5\u80fd\u8f49\u5316\u70ba\u5be6\u8cea\u8ca1\u5831\u6548\u76ca\u300d\u3002\u9019\u53e5\u8a71\u662f\u9019\u6ce2 AI \u88c1\u54e1\u6f6e\u7684\u95dc\u9375\u8a3b\u8173\uff1a\u88c1\u54e1\u662f\u771f\u7684\uff0cAI \u662f\u771f\u7684\uff0c\u7701\u4e0b\u7684\u9322\u80fd\u4e0d\u80fd\u8b8a\u6210\u7372\u5229\u3001\u9084\u662f\u88ab AI \u57fa\u790e\u8a2d\u65bd\u652f\u51fa\u5403\u6389\uff0c\u662f\u53e6\u4e00\u500b\u554f\u984c\u3002\n\n\u5c0d\u7167\u7d44\u662f Intuit 5/20 \u5ba3\u5e03\u7684 3,000 \u4eba\u88c1\u54e1\uff0817%\uff09\u3002CEO Sasan Goodarzi \u5c0d CNBC \u53cd\u99c1\u8aaa\u300c\u8ddf AI \u4e00\u9ede\u95dc\u4fc2\u90fd\u6c92\u6709\u300d\uff0c\u540c\u65e5\u537b\u516c\u5e03 Q3 \u71df\u6536 86 \u5104\u7f8e\u5143\u3001\u5e74\u589e 10%\u3001\u4e0a\u8abf\u5168\u5e74\u8ca1\u6e2c\uff0c\u6388\u6b0a 80 \u5104\u7f8e\u5143\u5eab\u85cf\u80a1\u3002\u5e02\u5834\u986f\u7136\u4e0d\u8cb7\u55ae\uff0cIntuit \u80a1\u50f9\u4eca\u5e74\u5df2\u8dcc 41%\u3002\u540c\u4e00\u9031\u5169\u5bb6\u516c\u53f8\uff0c\u4e00\u5bb6\u9ad8\u8abf\u8aaa\u300c\u70ba\u4e86 AI\u300d\uff0c\u4e00\u5bb6\u5805\u6301\u300c\u8ddf AI \u7121\u95dc\u300d\uff0c\u5287\u672c\u53cd\u5dee\u5f88\u503c\u5f97\u73a9\u5473\u3002\n\n**\u503c\u5f97\u6df1\u6316\uff1a**\n\n- \u300c\u767e\u842c\u7f8e\u5143\u85aa\u6c34\u5e36\u300d\u662f\u771f\u7684\u53ef\u4ee5\u767c\u51fa\u53bb\u7684\u627f\u8afe\uff0c\u9084\u662f\u7528\u4f86\u51dd\u805a\u5269\u9918\u54e1\u5de5\u58eb\u6c23\u7684\u8a71\u8853\u3002\u600e\u9ebc\u5b9a\u7fa9\u300c100 \u500d\u7522\u51fa\u300d\uff1f\u662f\u71df\u6536\uff1f\u5de5\u55ae\u6578\uff1fcode commit\uff1f\u9019\u500b\u91cf\u5316\u6a19\u6e96\u4e00\u65e6\u516c\u958b\uff0c\u5c31\u6703\u88ab\u54e1\u5de5 reverse engineer \u51fa\u6700\u5bb9\u6613\u904e\u95dc\u7684\u6307\u6a19\u3002\n- ClickUp \u628a\u54e1\u5de5\u89d2\u8272\u91cd\u65b0\u5b9a\u7fa9\u6210\u300cagent \u6307\u63ee\u8005\u300d\u662f\u65b0\u8a5e\u820a\u9152\uff0c\u9084\u662f\u771f\u7684\u6709\u7d50\u69cb\u6027\u5dee\u7570\u3002\u4e2d\u968e\u4e3b\u7ba1\u539f\u672c\u5c31\u662f\u5728\u6307\u63ee\u4eba\uff0c\u73fe\u5728\u6307\u63ee agent\uff0c\u5de5\u4f5c\u5167\u5bb9\u662f\u4e0d\u662f\u5176\u5be6\u53ea\u63db\u4e86\u88ab\u7ba1\u8005\u7684\u7269\u7a2e\u3002\n- Intuit CEO \u7684\u8a71\u300c\u4eba\u5011\u5728\u7a05\u52d9\u8ddf\u6703\u8a08\u5c08\u696d\u4e0a\u82b1\u7684\u9322\u662f\u8edf\u9ad4\u7684\u4e03\u500d\uff0c\u56e0\u70ba\u8cb7\u7684\u4e0d\u662f\u7a0b\u5f0f\u78bc\uff0c\u662f\u4fe1\u5fc3\u300d\u5f88\u503c\u5f97\u653e\u9032\u77fd\u8c37\u8f15\u9b06\u8ac7\u8a0e\u8ad6\u3002LLM \u771f\u7684\u6703\u5403\u6389 SaaS \u7684\u8edf\u9ad4\u5c64\uff0c\u9084\u662f\u6703\u53cd\u800c\u8b93\u300c\u4fe1\u5fc3\u6ea2\u50f9\u300d\u9019\u500b\u975e\u6280\u8853\u8b77\u57ce\u6cb3\u8b8a\u5f97\u66f4\u503c\u9322\u3002\n\n**\u53c3\u8003\u9023\u7d50\uff1a**\n\n- https://techcrunch.com/2026/05/25/what-clickups-mass-layoff-tells-us-about-the-future-of-work/\n- https://techcrunch.com/2026/05/20/intuit-to-lay-off-over-3000-employees-to-refocus-on-ai/\n\n---\n\n## 3. Brett Adcock \u7684 Hark \u5b8c\u6210 7 \u5104\u7f8e\u5143 A \u8f2a\uff0c\u6574\u689d\u6676\u7247\u4f9b\u61c9\u93c8\u540c\u6846\n\nFigure.AI \u8207 Archer Aviation \u5275\u8fa6\u4eba Brett Adcock \u4e3b\u5c0e\u7684\u96b1\u8eab\u65b0\u5275 Hark\uff0c\u5b8c\u6210\u7531 Parkway Venture Capital \u9818\u6295\u7684 7 \u5104\u7f8e\u5143 A \u8f2a\uff0cpost-money \u4f30\u503c 60 \u5104\u7f8e\u5143\u3002\u7522\u54c1\u9084\u6c92\u4eae\u76f8\uff0cdemo \u4e5f\u50c5\u7d66\u5c11\u6578\u6295\u8cc7\u4eba\u770b\u904e\u3002\n\n\u771f\u6b63\u4e0d\u5c0b\u5e38\u7684\u662f cap table\u3002NVIDIA\u3001AMD Ventures\u3001Intel Capital\u3001Qualcomm Ventures \u540c\u6642\u51fa\u73fe\u5728\u6295\u8cc7\u4eba\u540d\u55ae\u4e0a\uff0c\u518d\u52a0\u4e0a Salesforce Ventures\u3001ARK Invest\u3001Brookfield\u3001Greycroft\u3002\u9019\u56db\u5bb6\u672c\u4f86\u662f\u6fc0\u70c8\u7af6\u722d\u7684\u6676\u7247\u5ee0\uff0c\u5e7e\u4e4e\u4e0d\u6703\u51fa\u73fe\u5728\u540c\u4e00\u5f35 cap table \u4e0a\u3002Hark \u76ee\u524d 70 \u4eba\uff0c\u81ea\u5efa\u914d\u5099 NVIDIA B200 GPU \u7684\u8cc7\u6599\u4e2d\u5fc3\uff0c\u8a08\u756b\u64f4\u7de8\u5230 200 \u540d\u5de5\u7a0b\u5e2b\uff0c\u4eca\u590f\u6703\u91cb\u51fa\u7b2c\u4e00\u6279\u591a\u6a21\u614b\u6a21\u578b\uff0c\u642d\u914d\u81ea\u5bb6\u786c\u9ad4\u88dd\u7f6e\uff0c\u4e3b\u6253\u300c\u901a\u7528\u4eba\u6a5f\u4ecb\u9762\u300d\u8207 agentic \u500b\u4eba\u52a9\u7406\u3002\n\n\u628a NVIDIA\u3001AMD\u3001Intel\u3001Qualcomm \u540c\u6642\u62c9\u9032\u4f86\u7684\u80fd\u529b\uff0c\u6bd4 7 \u5104\u7f8e\u5143\u672c\u8eab\u66f4\u8aaa\u660e\u554f\u984c\u3002Adcock \u5728 Figure.AI \u90a3\u908a\u5df2\u7d93\u5efa\u7acb\u904e\u300c\u540c\u6642\u8ddf\u591a\u5bb6\u6676\u7247\u5ee0\u5408\u4f5c\u3001\u4e0d\u9078\u908a\u7ad9\u300d\u7684\u7bc4\u672c\uff0c\u9019\u6b21\u986f\u7136\u628a\u540c\u6a23\u7684\u73a9\u6cd5\u642c\u5230\u4e00\u5bb6\u66f4\u65e9\u671f\u7684\u516c\u53f8\u3002\n\n**\u503c\u5f97\u6df1\u6316\uff1a**\n\n- \u70ba\u4ec0\u9ebc\u9019\u56db\u5bb6\u6676\u7247\u5ee0\u90fd\u9858\u610f\u9032\u4f86\u3002\u5982\u679c Hark \u7684\u300c\u901a\u7528\u4eba\u6a5f\u4ecb\u9762\u300d\u9700\u8981\u6df7\u7528 GPU\u3001NPU\u3001\u908a\u7de3\u6676\u7247\uff0c\u90a3\u9019\u5f35 cap table \u5c31\u662f\u4e00\u500b\u8a0a\u865f\uff1a\u4eba\u5f62\u6a5f\u5668\u4eba / \u500b\u4eba\u52a9\u7406\u6642\u4ee3\uff0c\u6c92\u6709\u55ae\u4e00\u6676\u7247\u80fd\u901a\u5403\u3002\n- Brett Adcock \u540c\u6642\u7d93\u71df Figure.AI\u3001Archer\u3001Hark\uff0c\u5206\u8eab\u80fd\u529b\u662f\u771f\u5f37\u9084\u662f\u9ad8\u5ea6\u69d3\u687f\u3002\u4ed6\u81ea\u638f 1 \u5104\u7f8e\u5143\u555f\u52d5 Hark \u7684\u6545\u4e8b\uff0c\u8ddf\u540c\u6642\u671f\u5176\u4ed6\u300c\u5275\u8fa6\u4eba\u9023\u7e8c\u958b\u65b0\u516c\u53f8\u300d\u7684\u6848\u4f8b\u600e\u9ebc\u5c0d\u6bd4\u3002\n- Demo \u9084\u6c92\u7d66\u5916\u4eba\u770b\u5c31\u62ff\u5230 60 \u5104\u4f30\u503c\uff0c\u9019\u4ee3\u8868\u73fe\u5728 AI \u65e9\u671f\u5e02\u5834\u300c\u4eba\u6bd4\u7522\u54c1\u91cd\u8981\u300d\u7684\u7a0b\u5ea6\u6bd4 2021 \u9084\u8a87\u5f35\u3002\u7576\u9019\u500b\u500d\u6578\u958b\u59cb\u53cd\u8f49\u6642\uff0c\u6703\u662f\u4ec0\u9ebc\u5f62\u614b\u3002\n\n**\u53c3\u8003\u9023\u7d50\uff1a**\n\n- https://techcrunch.com/2026/05/21/hark-raises-700m-series-a-for-its-secretive-universal-ai-interface/\n\n---\n\n## 4. \u6559\u5b97 Leo XIV \u9996\u90e8\u901a\u8aed\u8ac7 AI\uff0cAnthropic \u5171\u540c\u5275\u8fa6\u4eba\u5230\u5834\n\n\u6559\u5b97 Leo XIV \u767c\u5e03\u9577\u9054 42,000 \u5b57\u7684\u9996\u90e8\u6559\u5b97\u901a\u8aed\u300aMagnifica Humanitas\u300b\uff0c\u4e3b\u984c\u662f\u300c\u5728 AI \u6642\u4ee3\u5b88\u8b77\u4eba\u7684\u5c0a\u56b4\u300d\u3002\u6587\u4ef6\u547c\u7c72\u5efa\u7acb\u65b0\u7684\u6cd5\u5f8b\u8207\u502b\u7406\u6846\u67b6\uff0c\u53cd\u5c0d\u81ea\u4e3b AI \u6b66\u5668\u3001\u8981\u6c42 AI \u81ea\u52d5\u5316\u8981\u4f34\u96a8\u52de\u5de5\u518d\u57f9\u8a13\u8207\u4fdd\u8b77\uff0c\u4e26\u6279\u8a55\u300c\u4ee5\u5229\u6f64\u5076\u50cf\u5316\u72a7\u7272\u5f31\u52e2\u300d\u7684\u79d1\u6280\u614b\u5ea6\u3002\n\n\u9078\u5728 5/15 \u7c3d\u7f72\u6709\u610f\u601d\uff0c\u547c\u61c9 1891 \u5e74\u6559\u5b97 Leo XIII \u7684\u300aRerum Novarum\u300b\u5de5\u696d\u9769\u547d\u52de\u5de5\u901a\u8aed\u3002\u63db\u53e5\u8a71\u8aaa\uff0c\u9019\u4f4d\u6559\u5b97\u523b\u610f\u628a AI \u6642\u4ee3\u5b9a\u4f4d\u6210\u300c\u7b2c\u4e8c\u6b21\u5de5\u696d\u9769\u547d\u300d\u7d1a\u5225\u7684\u4eba\u985e\u8655\u5883\u8b8a\u5316\u3002\u767c\u8868\u7576\u5929 Anthropic \u5171\u540c\u5275\u8fa6\u4eba Chris Olah \u89aa\u81e8\u73fe\u5834\uff0c\u6559\u5b97\u5c0d\u4ed6\u8aaa\uff1a\u300c\u6211\u63a5\u53d7\u4f60\u7684\u9080\u8acb\uff0c\u8207\u4f60\u540c\u884c\uff0c\u50be\u807d\u3001\u5c0d\u8a71\uff0c\u4e00\u8d77\u627e\u51fa\u5728 AI \u6642\u4ee3\u7684\u4eba\u985e\u9053\u8def\u3002\u300d\n\nPolitico \u5831\u5c0e\uff0cAmazon\u3001Meta\u3001Google \u90fd\u5728\u901a\u8aed\u516c\u5e03\u524d\u66fe\u8207\u68b5\u8482\u5ca1\u63a5\u89f8\u8a66\u5716\u5f71\u97ff\u7acb\u5834\u3002\u6700\u7d42\u51fa\u4f86\u7684\u7248\u672c\u986f\u7136\u6c92\u88ab\u90a3\u4e9b\u904a\u8aaa\u64cb\u4f4f\uff0cArs Technica \u88dc\u5145\u6559\u5b97\u547c\u7c72\u300c\u62c6\u9664 AI \u7684\u6b66\u88dd\u300d\uff0c\u8a8d\u70ba\u55ae\u9760\u6280\u8853\u81ea\u5f8b\u300c\u4e0d\u8db3\u5920\u300d\u3002\n\n**\u503c\u5f97\u6df1\u6316\uff1a**\n\n- \u70ba\u4ec0\u9ebc\u662f Anthropic \u7684 Chris Olah \u5728\u5834\uff0c\u800c\u4e0d\u662f OpenAI\u3001Google\u3001Meta \u7684\u4eba\u3002Anthropic \u5728\u300cAI \u9053\u5fb7\u8ad6\u8ff0\u300d\u9019\u689d\u6230\u7dda\u4e0a\u4f3c\u4e4e\u6b63\u5728\u7d2f\u7a4d\u8207\u5b97\u6559\u3001\u4eba\u6587\u6a5f\u69cb\u7684\u95dc\u4fc2\u8cc7\u672c\uff0c\u9019\u5c0d\u9577\u671f\u54c1\u724c\u5b9a\u4f4d\u662f\u4ec0\u9ebc\u610f\u601d\u3002\n- \u6559\u5b97\u901a\u8aed\u5728 EU AI Act \u8207\u7f8e\u570b\u884c\u653f\u547d\u4ee4\u4e4b\u9593\u7684\u7070\u8272\u5730\u5e36\u63d0\u4f9b\u4e86\u300c\u9053\u5fb7 anchoring\u300d\u3002\u7576\u9019\u4efd\u6587\u4ef6\u88ab\u5929\u4e3b\u6559 1 \u5104\u7d1a\u4fe1\u5f92\u7fa4\u9ad4\u5438\u6536\u5f8c\uff0c\u5c0d\u6c11\u610f\u98a8\u5411\uff08\u7279\u5225\u662f\u62c9\u7f8e\u3001\u83f2\u5f8b\u8cd3\u3001\u6771\u6b50\uff09\u7684\u5f71\u97ff\u503c\u5f97\u8ffd\u8e64\u3002\n- \u5c0d\u53f0\u7063\u793e\u6703\u7684 relevance\uff1a\u5929\u4e3b\u6559\u4e0d\u662f\u4e3b\u8981\u5b97\u6559\uff0c\u4f46\u300c\u4ee5\u4eba\u70ba\u672c\u300d\u7684\u8ad6\u8ff0\u6846\u67b6\u5728\u83ef\u8a9e\u5708\u88ab\u5f88\u591a\u4eba\u5f15\u7528\u3002\u53ef\u9810\u671f\u672a\u4f86\u5e7e\u500b\u6708\u6703\u770b\u5230\u9019\u4efd\u901a\u8aed\u88ab\u7ffb\u8b6f\u6210\u4e2d\u6587\u3001\u8b8a\u6210 AI \u76e3\u7ba1\u8a0e\u8ad6\u7684\u5f15\u7528\u4f86\u6e90\u3002\n\n**\u53c3\u8003\u9023\u7d50\uff1a**\n\n- https://www.theverge.com/news/936945/pope-leo-letter-encyclical-ai-anthropic-labor-warfare\n- https://arstechnica.com/tech-policy/2026/05/citing-gandalf-pope-leo-says-we-must-disarm-ai/\n\n---\n\n## 5. AI ROI \u958b\u59cb\u88ab\u56b4\u8085\u8cea\u7591\uff0cUber \u7e3d\u88c1\u8aaa\u300c\u8d8a\u4f86\u8d8a\u96e3\u81ea\u5713\u5176\u8aaa\u300d\n\nHacker News \u904e\u53bb 24 \u5c0f\u6642\u7684\u982d\u689d\u6545\u4e8b\u662f Nolan Lawson \u7684\u9577\u6587\u3008Using AI to write better code more slowly\u3009\uff0c988 \u5206\u3001372 \u5247\u8a55\u8ad6\u3002\u6a19\u984c\u5df2\u7d93\u8aaa\u5b8c\u4e86\uff1a\u7528 AI \u5beb\u7a0b\u5f0f\u53ef\u4ee5\u5beb\u51fa\u66f4\u597d\u7684\u7a0b\u5f0f\u78bc\uff0c\u4f46\u9700\u8981\u66f4\u591a\u6642\u9593\uff0c\u56e0\u70ba\u8981\u4e0d\u65b7\u6aa2\u67e5\u3001\u4fee\u6b63\u3001\u91cd\u65b0 prompt\u3002\u5c0d\u500b\u5225\u958b\u767c\u8005\u4f86\u8aaa\uff0c\u9019\u500b tradeoff \u4e0d\u4e00\u5b9a\u5212\u7b97\u3002\n\n\u540c\u4e00\u5929 Uber \u7e3d\u88c1 Andrew Macdonald \u5c0d\u5916\u516c\u958b\u8868\u793a\uff0c\u516c\u53f8\u7684 AI \u6295\u8cc7\u300c\u8d8a\u4f86\u8d8a\u96e3\u81ea\u5713\u5176\u8aaa\u300d\uff08harder to justify\uff09\u3002\u9019\u5728\u904e\u53bb\u5169\u5e74\u662f\u7981\u5fcc\u8a5e\uff0c\u73fe\u5728\u5927\u578b\u4e0a\u5e02\u516c\u53f8\u7684 C-level \u958b\u59cb\u516c\u958b\u8b1b\u51fa\u4f86\u3002HN 173 \u5206\u300183 \u5247\u8a55\u8ad6\u3002\n\n\u53e6\u4e00\u7bc7 115 \u5206\u7684\u3008Outsourcing plus LocalAI will soon become more economical vs Frontier labs\u3009\u63d0\u51fa\u66f4\u5c16\u92b3\u7684\u8ad6\u9ede\uff1a\u628a\u5de5\u4f5c\u5916\u5305\u5230\u4f4e\u6210\u672c\u5730\u5340\uff0c\u52a0\u4e0a\u672c\u5730\u5c0f\u6a21\u578b\u4f5c\u70ba\u8f14\u52a9\uff0c\u7e3d\u6210\u672c\u53ef\u80fd\u4f4e\u65bc\u7528 frontier model API\u3002\u5c0d Anthropic \u8207 OpenAI \u7684 token \u5b9a\u50f9\u7b56\u7565\u662f\u500b\u7d50\u69cb\u6027\u58d3\u529b\u3002\n\n\u52a0\u4e0a DeepSeek V4-Pro \u628a 75% \u6298\u6263\u6c38\u4e45\u5316\uff08$0.435/M in\u3001$0.87/M out\uff09\uff0c\u6df7\u5408\u5b9a\u50f9\u964d\u5230 $0.18/M\uff0c\u7d04\u662f Gemini 3.1 Pro Preview \u7684 1/3\u3001GPT-5.5 \u7684 1/12\u3001Claude Opus 4.7 \u7684 1/19\u3002\u4e2d\u570b\u958b\u6e90\u6a21\u578b + \u6c38\u4e45\u4f4e\u50f9\uff0c\u6b63\u5728\u628a\u6574\u500b inference cost \u66f2\u7dda\u5f80\u4e0b\u62d6\u3002\n\n**\u503c\u5f97\u6df1\u6316\uff1a**\n\n- \u300cAI \u8b93\u6211\u5beb\u5f97\u66f4\u597d\u4f46\u66f4\u6162\u300d\u9019\u500b\u9ad4\u611f\u8ddf Stack Overflow \u7684\u554f\u7b54\u6a21\u5f0f\u6709\u4ec0\u9ebc\u5171\u901a\u8207\u4e0d\u540c\u3002\u5f9e SO \u6284\u7b54\u6848\u4e0d\u6703\u66f4\u6162\uff0c\u5f9e LLM \u6284\u7b54\u6848\u6703\u6162\uff0c\u5dee\u5225\u5728\u54ea\u88e1\u3002\u662f\u56e0\u70ba LLM \u7b54\u6848\u7684\u300c\u4e0d\u78ba\u5b9a\u6027\u300d\u9700\u8981\u66f4\u591a\u4eba\u985e\u9a57\u8b49\u55ce\u3002\n- Uber \u7e3d\u88c1\u9019\u53e5\u8a71\u6703\u4e0d\u6703\u5e36\u8d77\u4e00\u6ce2\u300cAI ROI \u516c\u958b\u8cea\u7591\u6f6e\u300d\u3002\u5982\u679c\u63a5\u4e0b\u4f86\u4e00\u5169\u5b63\u53c8\u6709\u5169\u4e09\u5bb6\u5927\u516c\u53f8\u8ddf\u9032\uff0c\u6703\u4e0d\u6703\u662f\u9019\u6ce2 AI \u6295\u8cc7\u9031\u671f\u7684\u8f49\u6298\u8a0a\u865f\u3002\n- DeepSeek \u7684\u5b9a\u50f9\u5982\u679c\u4e0d\u662f\u88dc\u8cbc\u6230\u3001\u662f\u771f\u5be6\u6210\u672c\uff0c\u90a3 OpenAI \u8207 Anthropic \u7684 margin \u6a21\u578b\u6703\u6709\u591a\u5927\u58d3\u529b\u3002Anthropic \u5373\u5c07\u9996\u6b21\u55ae\u5b63\u7372\u5229\u9019\u4ef6\u4e8b\uff0c\u5728 DeepSeek \u5b9a\u50f9\u6301\u7e8c\u4e0b\u6bba\u7684\u80cc\u666f\u4e0b\u9084\u80fd\u7dad\u6301\u55ce\u3002\n\n**\u53c3\u8003\u9023\u7d50\uff1a**\n\n- https://nolanlawson.com/2026/05/25/using-ai-to-write-better-code-more-slowly/\n- https://news.ycombinator.com/item?id=48272984\n- https://www.theverge.com/transportation/937116/uber-ai-investment-hard-to-justify\n- https://news.ycombinator.com/item?id=48277485\n- https://www.signalbloom.ai/posts/outsourcing-plus-localai-will-soon-become-more-economical-vs-frontier-labs/\n- https://news.ycombinator.com/item?id=48278610\n\n---\n\n## 6. Cerebras \u7528 Moonshot Kimi K2.6 \u8dd1\u51fa\u8fd1 1,000 tokens/\u79d2\n\n\u525b\u5b8c\u6210 2026 \u5e74\u6700\u5927\u79d1\u6280 IPO \u7684 Cerebras Systems \u5ba3\u5e03\uff0c\u5df2\u80fd\u7528\u81ea\u5bb6\u6676\u7247\u4ee5\u63a5\u8fd1 1,000 tokens/\u79d2\u7684\u901f\u5ea6\uff0c\u70ba\u4f01\u696d\u5ba2\u6236\u57f7\u884c\u5317\u4eac Moonshot AI \u7684 trillion-parameter open-weight \u6a21\u578b Kimi K2.6\u3002\u9019\u500b\u63a8\u8ad6\u901f\u5ea6\u662f\u76ee\u524d\u4e3b\u6d41 GPU \u5e73\u53f0\u7121\u6cd5\u63a5\u8fd1\u7684\u6c34\u6e96\u3002\n\nCerebras \u7684\u5b9a\u4f4d\u5f88\u6e05\u695a\uff1a\u6436\u4e0b AI \u63a8\u8ad6\u5e02\u5834\u7684\u95dc\u9375\u6230\u7565\u9ede\uff0c\u7279\u5225\u662f\u91dd\u5c0d agentic AI \u8207 reasoning model \u5c0d token throughput \u7684\u7206\u70b8\u6027\u9700\u6c42\u3002\u7576\u4e00\u500b agent \u53ef\u80fd\u8981\u5728\u80cc\u666f\u8dd1\u5e7e\u5341\u500b reasoning step\u3001\u6bcf\u500b step \u8981\u751f\u6210\u5e7e\u5343\u500b token \u6642\uff0cthroughput \u4e0d\u662f nice-to-have\uff0c\u662f\u80fd\u4e0d\u80fd\u8dd1\u5f97\u8d77\u4f86\u7684\u9580\u6abb\u3002\n\n\u503c\u5f97\u6ce8\u610f\u7684\u642d\u914d\u662f\u300c\u4e2d\u570b\u958b\u6e90\u6a21\u578b + \u7f8e\u570b\u975e GPU \u52a0\u901f\u786c\u9ad4\u300d\u3002Kimi K2.6 \u662f\u958b\u6e90\u6b0a\u91cd\uff0c\u53ef\u4ee5\u90e8\u7f72\u5230\u4efb\u4f55\u5920\u5f37\u7684\u786c\u9ad4\u4e0a\uff1bCerebras \u662f wafer-scale chip\uff0c\u8ddf NVIDIA GPU \u662f\u5b8c\u5168\u4e0d\u540c\u7684\u67b6\u69cb\u8def\u7dda\u3002\u9019\u500b\u7d44\u5408\u5728\u5730\u7de3\u653f\u6cbb\u4e0a\u5f88\u5fae\u5999\uff1a\u6a21\u578b\u4f86\u81ea\u4e2d\u570b\u3001\u786c\u9ad4\u4f86\u81ea\u7f8e\u570b\uff0c\u4f46\u5169\u908a\u7684\u5ba2\u6236\u53ef\u80fd\u90fd\u662f\u7f8e\u570b\u4f01\u696d\u3002\n\n**\u503c\u5f97\u6df1\u6316\uff1a**\n\n- Cerebras \u7684\u63a8\u8ad6\u901f\u5ea6\u512a\u52e2\u80fd\u4e0d\u80fd\u8b8a\u6210\u6301\u4e45\u7684\u5546\u696d\u512a\u52e2\uff0c\u9084\u662f\u53ea\u662f demo \u7d1a\u5225\u7684 benchmark\u3002\u5be6\u969b\u4f01\u696d\u90e8\u7f72\u6642\uff0c\u6574\u500b inference stack\uff08KV cache\u3001batching\u3001serving\uff09\u80fd\u4e0d\u80fd\u914d\u5408 wafer-scale \u7684\u7279\u6027\u767c\u63ee\u3002\n- \u70ba\u4ec0\u9ebc\u662f Kimi K2.6 \u800c\u4e0d\u662f Llama\u3001Qwen\u3001DeepSeek\u3002Moonshot \u5728\u958b\u6e90\u5708\u904e\u53bb\u8072\u91cf\u4e0d\u7b97\u6700\u5927\uff0c\u9019\u6b21\u8ddf Cerebras \u7684\u5408\u4f5c\u6703\u4e0d\u6703\u628a\u5b83\u63a8\u5230 top tier \u958b\u6e90\u6b0a\u91cd\u7684\u4f4d\u7f6e\u3002\n- \u5982\u679c Cerebras \u771f\u7684\u80fd\u5728 inference \u7aef\u7ad9\u7a69\uff0cNVIDIA \u5728 training + inference \u5168\u5305\u7684\u683c\u5c40\u6703\u88ab\u5207\u958b\u3002\u5c0d\u6574\u9ad4\u6676\u7247\u5e02\u5834\u7684\u9577\u671f P/E \u60f3\u50cf\u6709\u4ec0\u9ebc\u5f71\u97ff\u3002\n\n**\u53c3\u8003\u9023\u7d50\uff1a**\n\n- https://venturebeat.com/category/ai/\n\n---\n\n## 7. \u6280\u8853\u793e\u7fa4\u5feb\u5831\n\n**MCP 2026-07-28 RC \u6539\u70ba stateless \u5354\u8b70** \u2014 \u7121 handshake\u3001\u7121 session ID\uff0c\u4efb\u4f55 request \u53ef\u6253\u4efb\u4f55 server instance\uff1b\u65b0\u589e MCP Apps\u3001Tasks \u4e00\u7d1a\u64f4\u5c55\u3001auth \u5f37\u5316\u3002MCP \u5f9e\u300c\u5be6\u9a57\u6027\u5354\u8b70\u300d\u9032\u5165\u300c\u4f01\u696d\u53ef\u90e8\u7f72\u300d\u968e\u6bb5\u3002\n\ud83d\udd17 https://news.smol.ai/\n\n**Anthropic Claude Managed Agents \u4e0a\u7dda self-hosted sandboxes \u8207 MCP tunnels** \u2014 \u628a agent loop \u7559\u5728 Anthropic \u57fa\u790e\u8a2d\u65bd\u3001\u5de5\u5177\u57f7\u884c\u4e0b\u653e\u5230\u4f01\u696d\u7aef\uff0c\u6191\u8b49\u4e0d\u96e2\u958b\u4f01\u696d\u7db2\u8def\u3002\u9019\u662f\u4f01\u696d agent \u5b89\u5168\u67b6\u69cb\u7684\u660e\u78ba\u5206\u6c34\u5dba\u3002\n\ud83d\udd17 https://venturebeat.com/orchestration/claude-agents-can-finally-connect-to-enterprise-apis-without-leaking-credentials\n\n**Claude \u627e\u5230 Apple macOS 26.5 \u6838\u5fc3\u6f0f\u6d1e CVE-2026-28952** \u2014 AI \u653b\u9632\u5be6\u6230\uff0cHN 161 \u5206\u3002\n\ud83d\udd17 https://support.apple.com/en-us/127115\n\n**Microsoft Copilot Cowork \u88ab\u7206\u6a94\u6848\u5916\u6d29\u6f0f\u6d1e** \u2014 agent \u9023\u4f01\u696d\u6a94\u6848\u7cfb\u7d71\u7684\u5b89\u5168\u4ee3\u50f9\uff0cHN 253 \u5206\u300148 \u5247\u8a55\u8ad6\u3002\n\ud83d\udd17 https://www.promptarmor.com/resources/microsoft-copilot-cowork-exfiltrates-files\n\n**Motorola \u624b\u6a5f\u88ab\u767c\u73fe\u52ab\u6301 Amazon app \u63d2\u5165 affiliate code** \u2014 \u9810\u8f09\u97cc\u9ad4\u5c64\u7d1a\u7684\u5ee0\u5546\u8caa\u5a6a\uff0cHN 333 \u5206\u3002\n\ud83d\udd17 https://9to5google.com/2026/05/25/motorola-amazon-app-hijacking-behavior/\n\n**GitHub Actions \u5168\u7403\u7576\u6a5f\u6578\u5c0f\u6642** \u2014 \u53c8\u4e00\u6b21\u63d0\u9192 CI/CD \u55ae\u9ede\u4f9d\u8cf4\u98a8\u96aa\uff0cHN 631 \u5206\u3002\n\ud83d\udd17 https://www.githubstatus.com/?today\n\n**OpenAI \u901a\u7528\u6a21\u578b\u89e3\u51fa unit distance \u6578\u5b78\u554f\u984c** \u2014 Zvi \u5f62\u5bb9\u662f AI \u81ea\u4e3b\u7522\u751f\u7684\u300c\u7b2c\u4e00\u500b\u771f\u6b63\u4ee4\u4eba\u5370\u8c61\u6df1\u523b\u300d\u7684\u6578\u5b78\u6210\u679c\uff0c\u672a\u7528 Lean\u3002\n\ud83d\udd17 https://thezvi.substack.com/p/ai-169-new-knowledge\n\n**Gary Marcus \u8b66\u544a S&P 500 \u9b06\u7d81\u7d0d\u5165\u898f\u5247** \u2014 Tesla PE \u5df2 383 \u500d\uff0cOpenAI\u3001Anthropic IPO \u4f30\u503c\u82e5\u88ab\u5feb\u901f\u585e\u5165\u6307\u6578\uff0c\u5168\u7f8e\u9000\u4f11\u57fa\u91d1\u88ab\u52d5\u625b\u55ae\u3002\u8aee\u8a62\u671f 5/28 \u7d50\u675f\u3002\n\ud83d\udd17 https://garymarcus.substack.com/p/this-one-weird-trick-might-cost-your\n\n**Anthropic \u6bcf\u5e74\u4ed8 SpaceX \u7d04 150 \u5104\u7f8e\u5143\u79df\u8cc7\u6599\u4e2d\u5fc3** \u2014 \u540c\u6642\u8207\u5fae\u8edf\u8ac7 Azure \u4e0a\u4f7f\u7528 Maia 200 \u6676\u7247\u3002Anthropic \u57fa\u790e\u8a2d\u65bd\u53bb NVIDIA \u5316\u3001\u53bb\u81ea\u5efa\u5316\u7684\u7a0b\u5ea6\u6bd4\u5916\u754c\u4ee5\u70ba\u7684\u9084\u9ad8\u3002\n\ud83d\udd17 https://www.theverge.com/ai-artificial-intelligence\n\n**Aleksander Madry \u96e2\u958b OpenAI** \u2014 OpenAI \u524d Preparedness \u4e3b\u7ba1\uff0c\u8f49\u53bb\u7814\u7a76 AI \u7d93\u6fdf\u5f71\u97ff\u3002\u53c8\u4e00\u4f4d safety \u9ad8\u7ba1\u51fa\u8d70\u3002\n\ud83d\udd17 https://www.theverge.com/ai-artificial-intelligence\n\n---\n\n## \ud83c\udf99\ufe0f \u9078\u984c\u5efa\u8b70\uff08\u7d66\u77fd\u8c37\u8f15\u9b06\u8ac7\uff09\n\n**ClickUp + Intuit + Uber \u7684\u4e09\u7d44\u5c0d\u7167\uff08\u9ad8\u512a\u5148\uff09**\uff1a\u540c\u4e00\u9031\u4e09\u5bb6\u516c\u53f8\u5c0d\u300cAI \u8ddf\u88c1\u54e1\u7684\u95dc\u4fc2\u300d\u7d66\u51fa\u4e09\u7a2e\u4e0d\u540c\u8aaa\u6cd5\u3002ClickUp \u9ad8\u8abf\u8aaa\u70ba\u4e86 AI\u3001Intuit \u5426\u8a8d\u8ddf AI \u6709\u95dc\u3001Uber \u516c\u958b\u627f\u8a8d AI \u6295\u8cc7\u96e3\u81ea\u5713\u5176\u8aaa\u3002\u628a\u9019\u4e09\u500b\u6848\u4f8b\u64fa\u5728\u4e00\u8d77\u505a\u4e00\u96c6\uff0c\u8a0e\u8ad6\u300c\u4e0a\u5e02\u516c\u53f8 CFO \u8ddf CEO \u600e\u9ebc\u5305\u88dd AI \u6558\u4e8b\u300d\uff0c\u6bd4\u55ae\u7368\u8b1b\u4efb\u4f55\u4e00\u5bb6\u90fd\u6709\u5c64\u6b21\u3002Kenji \u5728 Square\u3001Brex\u3001Cruise \u5f85\u904e\uff0c\u5c0d\u4f01\u696d\u5167\u90e8\u8b1b\u8a71\u8853\u8ddf\u5c0d\u5916\u516c\u95dc\u5dee\u5225\u7684\u89c0\u5bdf\u53ef\u4ee5\u52a0\u9032\u4f86\u3002\n\n**Karpathy \u52a0\u76df Anthropic \u505a RSI**\uff1a\u9019\u500b\u6545\u4e8b\u7684\u6280\u8853\u89c0\u773e\u63a5\u53d7\u5ea6\u9ad8\uff0c\u53ef\u4ee5\u5f9e\u300c\u70ba\u4ec0\u9ebc Anthropic \u9858\u610f\u516c\u958b\u8b1b recursive self-improvement\u300d\u5207\u5165\uff0c\u8a0e\u8ad6 safety lab \u7684\u8ad6\u8ff0\u8f49\u8b8a\u3002\u914d\u5408 METR Frontier Risk Report \u7684 agent \u80fd\u529b\u6578\u64da\uff0c\u505a\u4e00\u96c6\u300c2026 \u5e74 agent \u771f\u5be6\u80fd\u529b\u76e4\u9ede\u300d\u3002\n\n**Cerebras + Kimi K2.6**\uff1a\u7d14\u6280\u8853\u9078\u984c\uff0c\u4f46\u5c0d\u5de5\u7a0b\u5e2b\u89c0\u773e\u6709\u5438\u5f15\u529b\u3002\u53ef\u4ee5\u5f9e\u300c\u70ba\u4ec0\u9ebc inference \u7a81\u7136\u8b8a\u6210\u7368\u7acb\u5e02\u5834\u300d\u5207\u5165\uff0c\u8a0e\u8ad6 wafer-scale chip \u8207 GPU \u7684\u67b6\u69cb\u5dee\u7570\u3001\u4ee5\u53ca agentic \u6642\u4ee3 token throughput \u7684\u9700\u6c42\u66f2\u7dda\u3002\n\n**Nolan Lawson \u7684\u300c\u7528 AI \u5beb\u7a0b\u5f0f\u66f4\u597d\u4f46\u66f4\u6162\u300d**\uff1a\u9019\u7bc7\u6587\u7ae0 988 \u5206\u3001372 \u8a55\u8ad6\uff0c\u662f\u5de5\u7a0b\u5e2b\u5708\u6700\u8fd1\u6700\u5927\u7684\u5171\u9cf4\u9ede\u3002Kenji \u81ea\u5df1\u7528 Claude Code\u3001Cursor \u7684\u5be6\u969b\u7d93\u9a57\u5f88\u9069\u5408\u5c0d\u61c9\u8a0e\u8ad6\uff0c\u53ef\u4ee5\u505a\u4e00\u96c6\u300cAI coding \u5de5\u5177\u7684\u771f\u5be6\u9ad4\u611f\u300d\uff0c\u4e0d\u8ca9\u8ce3\u6a02\u89c0\u4e5f\u4e0d\u8ca9\u8ce3\u60b2\u89c0\u3002\n\n**\u6559\u5b97 Leo XIV AI \u901a\u8aed**\uff1a\u76f8\u5c0d\u8edf\u6027\u7684\u9078\u984c\uff0c\u4f46 framing \u5f88\u7279\u5225\u3002\u53ef\u4ee5\u505a\u300c\u70ba\u4ec0\u9ebc\u5b97\u6559\u9818\u8896\u6bd4\u79d1\u6280\u516c\u53f8 CEO \u66f4\u6562\u76f4\u63a5\u8b1b AI \u5c0d\u4eba\u7684\u885d\u64ca\u300d\u9019\u500b\u89d2\u5ea6\uff0c\u914d\u5408\u5de5\u696d\u9769\u547d\u8207 AI \u9769\u547d\u7684\u6b77\u53f2\u985e\u6bd4\u3002\n", "creation_timestamp": "2026-05-26T16:56:55.000000Z"}, {"uuid": "7239a47f-f45d-4814-b4ee-cd00db4755f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/hot.hn/post/3mmrw4iec232h", "content": "\ud83d\udcf0 CVE-2026-28952: Apple macOS 26.5 Kernel Vuln found by Claude\n\n\ud83d\udd17 https://support.apple.com/en-us/127115\n\n\ud83d\udcac Discuss on HN", "creation_timestamp": "2026-05-26T21:17:15.415826Z"}, {"uuid": "b042a1e0-624c-4317-a731-37cb99df8d94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28952", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mmshngckkv2m", "content": "Top 3 CVE for last 7 days:\nCVE-2026-45250: 72 interactions\nCVE-2026-45584: 65 interactions\nCVE-2026-46727: 22 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-48710: 11 interactions\nCVE-2026-28952: 3 interactions\nCVE-2026-45659: 3 interactions\n", "creation_timestamp": "2026-05-27T02:30:58.142116Z"}, {"uuid": "a58b226e-3829-43e7-8d24-6db6b0a5c79b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28229", "type": "published-proof-of-concept", "source": "https://github.com/argoproj/argo-workflows/security/advisories/GHSA-56px-hm34-xqj5", "content": "", "creation_timestamp": "2026-03-11T10:08:40.000000Z"}, {"uuid": "70026944-2ddf-4aeb-aab4-258fb5e1348d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28685", "type": "published-proof-of-concept", "source": "https://github.com/kimai/kimai/security/advisories/GHSA-v33r-r6h2-8wr7", "content": "", "creation_timestamp": "2026-03-04T12:43:17.000000Z"}, {"uuid": "2a182f68-5dba-4ae9-8e47-37e8204b37ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28348", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mmtqfbqgri2a", "content": "\ud83d\udd17 CVE : CVE-2026-28348, CVE-2026-28350", "creation_timestamp": "2026-05-27T14:40:07.814769Z"}, {"uuid": "9fa89758-4c10-4195-8ea4-f86a0eed69c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28350", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mmtqfbqgri2a", "content": "\ud83d\udd17 CVE : CVE-2026-28348, CVE-2026-28350", "creation_timestamp": "2026-05-27T14:40:07.989117Z"}, {"uuid": "e9fbec2a-d004-4a08-a748-63324eadd9db", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28764", "type": "seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mmtv5fsqu426", "content": "@talosintelligence.com\nFour heap-based buffer overflow flaws in MediaArea MediaInfoLib allow arbitrary code execution via malicious files.\n-\nIOCs: CVE-2026-25104, CVE-2026-25713, CVE-2026-28764\n-\n#MediaArea #ThreatIntel #Vulnerability", "creation_timestamp": "2026-05-27T16:05:12.542805Z"}, {"uuid": "39570d1b-5f4d-4596-95c6-c316d9b78246", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28292", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-r275-fr43-pm7q", "content": "", "creation_timestamp": "2026-03-10T18:38:56.000000Z"}, {"uuid": "0667539c-9447-4e41-8f9b-c860f97bda69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28291", "type": "published-proof-of-concept", "source": "https://github.com/steveukx/git-js/security/advisories/GHSA-jcxm-m3jx-f287", "content": "", "creation_timestamp": "2026-04-12T15:13:14.000000Z"}, {"uuid": "bb72f1c3-5318-45ed-952e-92a98132c138", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28807", "type": "published-proof-of-concept", "source": "https://github.com/gleam-wisp/wisp/security/advisories/GHSA-h7cj-j2vv-qw8r", "content": "", "creation_timestamp": "2026-03-09T12:29:02.000000Z"}, {"uuid": "55cb2c77-92c7-43ff-8d19-126f4cbb9287", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28805", "type": "published-proof-of-concept", "source": "https://github.com/devcode-it/openstamanager/security/advisories/GHSA-3gw8-3mg3-jmpc", "content": "", "creation_timestamp": "2026-04-01T15:13:27.000000Z"}, {"uuid": "0c7d6185-1c6e-432d-9a7b-1f9c8dec06fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28786", "type": "published-proof-of-concept", "source": "https://github.com/open-webui/open-webui/security/advisories/GHSA-vvxm-vxmr-624h", "content": "", "creation_timestamp": "2026-03-26T23:29:07.000000Z"}, {"uuid": "9a0406cf-b71a-4778-ac01-86ad0d290a5d", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28496", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/88200ffd-9c29-4264-9c5a-cf89d01097a0", "content": "", "creation_timestamp": "2026-08-05T01:00:36.547810Z"}, {"uuid": "9814d774-3665-49aa-bc68-3665eea43017", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28788", "type": "published-proof-of-concept", "source": "https://github.com/open-webui/open-webui/security/advisories/GHSA-jjp7-g2jw-wh3j", "content": "", "creation_timestamp": "2026-03-26T23:27:57.000000Z"}, {"uuid": "449a9da8-cacd-4158-a9b0-a27c054240ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28350", "type": "published-proof-of-concept", "source": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-xvp8-3mhv-424c", "content": "", "creation_timestamp": "2026-03-02T08:19:59.000000Z"}, {"uuid": "8699c465-1262-4b6c-8242-f7feedb92cb1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28498", "type": "published-proof-of-concept", "source": "https://github.com/authlib/authlib/security/advisories/GHSA-m344-f55w-2m6j", "content": "", "creation_timestamp": "2026-03-15T17:48:43.000000Z"}, {"uuid": "279379c7-40d1-43cc-88f3-4dde2ca02acd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28792", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-8pw3-9m7f-q734", "content": "", "creation_timestamp": "2026-03-12T20:32:09.000000Z"}, {"uuid": "ce587dcd-d1e0-4d8f-8a3e-359d14ff4308", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28507", "type": "published-proof-of-concept", "source": "https://github.com/idno/idno/security/advisories/GHSA-37j7-56xc-c468", "content": "", "creation_timestamp": "2026-03-01T04:30:31.000000Z"}, {"uuid": "b79d25e2-f7ea-4a11-a7fa-05f4b4cc4bfd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28490", "type": "published-proof-of-concept", "source": "https://github.com/authlib/authlib/security/advisories/GHSA-7432-952r-cw78", "content": "", "creation_timestamp": "2026-03-15T17:48:25.000000Z"}, {"uuid": "cf81f060-c98f-4e78-a836-d2008d6f54fb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28793", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-2f24-mg4x-534q", "content": "", "creation_timestamp": "2026-03-12T20:32:26.000000Z"}, {"uuid": "002fa96a-0866-4b66-b847-7ace50874ebd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28448", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-33rq-m5x2-fvgf", "content": "", "creation_timestamp": "2026-02-17T21:37:55.000000Z"}, {"uuid": "82c6ec31-7ed1-4f85-a9ca-87a3469095e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28446", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-4rj2-gpmh-qq5x", "content": "", "creation_timestamp": "2026-02-17T21:36:34.000000Z"}, {"uuid": "5b4238a8-e979-4606-9aa1-eaff187d72d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28787", "type": "published-proof-of-concept", "source": "https://github.com/OneUptime/oneuptime/security/advisories/GHSA-gjjc-pcwp-c74m", "content": "", "creation_timestamp": "2026-03-01T19:54:22.000000Z"}, {"uuid": "28eb42f4-c7b2-4597-a3dd-143a563e7ca7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28791", "type": "published-proof-of-concept", "source": "https://github.com/tinacms/tinacms/security/advisories/GHSA-5hxf-c7j4-279c", "content": "", "creation_timestamp": "2026-03-12T05:09:56.000000Z"}, {"uuid": "a752fd25-e554-4924-81f7-ec220d216973", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28513", "type": "published-proof-of-concept", "source": "https://github.com/pocket-id/pocket-id/security/advisories/GHSA-qh6q-598w-w6m2", "content": "", "creation_timestamp": "2026-03-07T17:38:25.000000Z"}, {"uuid": "d9116c7a-174c-4477-8117-062e5437d756", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28338", "type": "published-proof-of-concept", "source": "https://github.com/pmd/pmd/security/advisories/GHSA-8rr6-2qw5-pc7r", "content": "", "creation_timestamp": "2026-02-27T12:50:43.000000Z"}, {"uuid": "3dc03316-311c-47d0-9ca8-1b399b7eaca7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28348", "type": "published-proof-of-concept", "source": "https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-hw26-mmpg-fqfg", "content": "", "creation_timestamp": "2026-03-02T08:20:21.000000Z"}, {"uuid": "34c2a493-377d-45cb-b38b-2558bab7de1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28697", "type": "published-proof-of-concept", "source": "https://github.com/craftcms/cms/security/advisories/GHSA-v47q-jxvr-p68x", "content": "", "creation_timestamp": "2026-03-02T23:05:25.000000Z"}, {"uuid": "3d84b84a-73d7-4eb1-b8b4-477492bb0b6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28802", "type": "published-proof-of-concept", "source": "https://github.com/authlib/authlib/security/advisories/GHSA-7wc2-qxgw-g8gg", "content": "", "creation_timestamp": "2026-03-04T14:32:31.000000Z"}, {"uuid": "b9af69ca-6921-4066-b6ae-96057528ab21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28794", "type": "published-proof-of-concept", "source": "https://github.com/middleapi/orpc/security/advisories/GHSA-m272-9rp6-32mc", "content": "", "creation_timestamp": "2026-03-02T02:33:00.000000Z"}, {"uuid": "cbda8080-2e16-42a7-89c9-c25d8ca74f58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28789", "type": "published-proof-of-concept", "source": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-45m3-398w-m2m9", "content": "", "creation_timestamp": "2026-03-01T23:59:25.000000Z"}, {"uuid": "9235105d-3902-4a37-8fcf-76eb53fced4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28508", "type": "published-proof-of-concept", "source": "https://github.com/idno/idno/security/advisories/GHSA-fcrh-fqxh-6fx6", "content": "", "creation_timestamp": "2026-03-01T04:30:09.000000Z"}, {"uuid": "848ee434-a019-4151-aec6-ab81d657f4fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28208", "type": "published-proof-of-concept", "source": "https://github.com/junrar/junrar/security/advisories/GHSA-j273-m5qq-6825", "content": "", "creation_timestamp": "2026-02-26T08:02:06.000000Z"}, {"uuid": "ff02ad43-4a71-4048-b2bb-1f5a57648ded", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28144", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3msjeoojgau22", "content": "CVE-2026-28144 wp-google-map-plugin (CVSS Score 4.3) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept", "creation_timestamp": "2026-08-07T20:15:10.929020Z"}, {"uuid": "a63426ee-6ec1-49d2-bb07-e8a631d3d3ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28467", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-wfp2-v9c7-fh79", "content": "", "creation_timestamp": "2026-02-17T21:30:48.000000Z"}, {"uuid": "e937397e-efad-4ef9-81a9-fdbf547f1f0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28492", "type": "published-proof-of-concept", "source": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-mr74-928f-rw69", "content": "", "creation_timestamp": "2026-02-28T10:46:01.000000Z"}, {"uuid": "9e768cfa-fca8-4331-a4ea-65df4a687016", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28790", "type": "published-proof-of-concept", "source": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-4fqm-6fmh-82mq", "content": "", "creation_timestamp": "2026-03-02T00:27:21.000000Z"}, {"uuid": "0a1b51db-b06b-4dab-95a0-56fb45022598", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28342", "type": "published-proof-of-concept", "source": "https://github.com/OliveTin/OliveTin/security/advisories/GHSA-pc8g-78pf-4xrp", "content": "", "creation_timestamp": "2026-03-01T23:34:09.000000Z"}, {"uuid": "ffb53bed-e956-4aed-acd8-bb2eeb95f199", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28414", "type": "published-proof-of-concept", "source": "https://github.com/gradio-app/gradio/security/advisories/GHSA-39mp-8hj3-5c49", "content": "", "creation_timestamp": "2026-02-27T20:22:53.000000Z"}, {"uuid": "d4f9d0e4-bb68-4fa3-8ed1-cbbde9b8bf2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28782", "type": "published-proof-of-concept", "source": "https://github.com/craftcms/cms/security/advisories/GHSA-jxm3-pmm2-9gf6", "content": "", "creation_timestamp": "2026-03-02T23:09:37.000000Z"}, {"uuid": "7b6b5769-065d-4cc9-a0d0-f56bbbc19b43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28781", "type": "published-proof-of-concept", "source": "https://github.com/craftcms/cms/security/advisories/GHSA-2xfc-g69j-x2mp", "content": "", "creation_timestamp": "2026-03-02T23:09:04.000000Z"}, {"uuid": "eca87399-8a40-4266-a302-0bb83f6bd7df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28695", "type": "published-proof-of-concept", "source": "https://github.com/craftcms/cms/security/advisories/GHSA-94rc-cqvm-m4pw", "content": "", "creation_timestamp": "2026-03-02T23:04:57.000000Z"}, {"uuid": "a83ab2c9-5bb6-4569-9848-97fc53bec41d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28416", "type": "published-proof-of-concept", "source": "https://github.com/gradio-app/gradio/security/advisories/GHSA-jmh7-g254-2cq9", "content": "", "creation_timestamp": "2026-02-27T20:24:13.000000Z"}, {"uuid": "2f9e8ef0-84ae-474e-a31c-5eb72f561756", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtekyrpn4h2c", "content": "CVE-2026-28192\nAn attacker can upload any file to a Piotnet Addons For Elementor Pro installation without needing a password. This can potentially lead to security issues if an attacker uploads malicious files. To protect\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-18T15:50:04.857679Z"}, {"uuid": "370ac4bf-e9bc-4dbe-86f1-88b6e002f428", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtelyt6q4p2c", "content": "\ud83d\udea8 CVE-2026-28192 \u2014 CVSS 9.6 CRITICAL\n\nUnauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-28192\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-18T16:08:00.058586Z"}, {"uuid": "60465d0e-5e01-4f2b-8455-58871f3c2296", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28323", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3msk4dqxqxl2d", "content": "The latest update for #ArcticWolf includes \"SolarWinds Web #HelpDesk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299\" and \"Payroll Pirates: Strange New Tides in Business Email Compromise\".\n \n#cybersecurity #infosec #networks https://opsmtrs.com/2ZFbaTl", "creation_timestamp": "2026-08-08T03:18:33.574982Z"}, {"uuid": "c3caa6fd-c986-4a20-b69b-161ce64ec697", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28299", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3msk4dqxqxl2d", "content": "The latest update for #ArcticWolf includes \"SolarWinds Web #HelpDesk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299\" and \"Payroll Pirates: Strange New Tides in Business Email Compromise\".\n \n#cybersecurity #infosec #networks https://opsmtrs.com/2ZFbaTl", "creation_timestamp": "2026-08-08T03:20:43.714937Z"}, {"uuid": "7ce2ff6f-44b7-48f2-bb4d-0a00262c0993", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/1ThaDno_W3Ka2b0qcRhQY27-XNg8SeWiGEBhbywH0dvG480h", "content": "", "creation_timestamp": "2026-08-21T04:00:04.178889Z"}, {"uuid": "dd89040c-033e-42ea-ac24-eaf3272a4042", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/b4WBtRo620bcBWWOg8X_RfJcTN35itwU9g11mGhdE2NlcRcc", "content": "", "creation_timestamp": "2026-08-21T04:00:04.084411Z"}, {"uuid": "49cc6822-d279-4518-8ece-494db8d6b120", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28761", "type": "seen", "source": "https://bsky.app/profile/keiwork35.bsky.social/post/3mmyf6ju52422", "content": "\u3010\u8106\u5f31\u6027\u60c5\u5831\u3011 CVE-2026-28761 Musetheque\u00a0V4\u306e\u8106\u5f31\u6027\u306b\u3064\u3044\u3066\n\nCVE-2026-28761\u306f\u3001Muse theque V4\u306b\u304a\u3051\u308b\u30af\u30ed\u30b9\u30b5\u30a4\u30c8\u30ea\u30af\u30a8\u30b9\u30c8\u30d5\u30a9\u30fc\u30b8\u30a7\u30ea\uff08CSRF\uff09\u8106\u5f31\u6027\u3067\u3059\u3002", "creation_timestamp": "2026-05-29T11:02:49.046260Z"}, {"uuid": "0fe75084-bf15-44dd-a6d8-910d66b4715e", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28409", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/f0638bc5-a4dd-4597-bb0c-63e845bfda04", "content": "", "creation_timestamp": "2026-08-05T11:00:22.131967Z"}, {"uuid": "2c00d380-cd6d-4689-85eb-6f86f41986e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28954", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mn6jlb6tsc2u", "content": "Apple\u3001\u300cmacOS Tahoe 26.5\u300d\u3092\u516c\u958b - \u8106\u5f31\u602779\u4ef6\u3092\u4fee\u6b63\n\nApple\u306f\u73fe\u5730\u6642\u95932026\u5e745\u670811\u65e5\u3001Mac\u5411\u3051\u306b\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u300cmacOS Tahoe 26.5\u300d\u300cmacOS Sequoia 15.7.7\u300d\u300cmacOS Sonoma 14.8.7\u300d\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u305f\u3002\n\n\u300cmacOS Tahoe 26.5\u300d\u3067\u306f\u3001CVE\u30d9\u30fc\u30b9\u306779\u4ef6\u306e\u8106\u5f31\u6027\u3092\u4fee\u6b63\u3002\u300cGatekeeper\u300d\u306b\u304a\u3051\u308b\u30c1\u30a7\u30c3\u30af\u3092\u30d0\u30a4\u30d1\u30b9\u3067\u304d\u308b\u300cCVE-2026-28954\u300d\u3092\u306f\u3058\u3081\u3001\u30ab\u30fc\u30cd\u30eb\u306b\u95a2\u3059\u308b9\u4ef6\u306e\u8106\u5f31\u6027\u306b\u5bfe\u51e6\u3057\u305f\u3002\n\n\u300cWebKit\u300d\u306b\u95a2\u3059\u308b\u8106\u5f31\u602720\u4ef6\u306e\u307b\u304b\u3001\u30a2\u30ab\u30a6\u30f3\u30c8\u3001CoreServi\u2026", "creation_timestamp": "2026-05-31T21:37:32.379109Z"}, {"uuid": "449f8194-9511-4605-b4a5-b76ab0777641", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28511", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mnbhf6duse25", "content": "CVE-2026-28511 - elabftw has entry title leakage through autocompletion search\nCVE ID : CVE-2026-28511\n \n Published : June 1, 2026, 11:16 p.m. | 1\u00a0hour, 16\u00a0minutes ago\n \n Description : eLabFTW is an open source electronic lab notebook. Prior to version 5.4.2, in certain cases,...", "creation_timestamp": "2026-06-02T01:36:16.508719Z"}, {"uuid": "d68f3116-d359-43c2-bfc4-4ce4d5792e24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28574", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260602", "content": "", "creation_timestamp": "2026-06-01T18:00:00.000000Z"}, {"uuid": "4e558510-0d4f-4023-8553-15af6e44a183", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28577", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260602", "content": "", "creation_timestamp": "2026-06-01T18:00:00.000000Z"}, {"uuid": "4370ada2-1e94-437b-8a77-cbf4539272b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28581", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260602", "content": "", "creation_timestamp": "2026-06-01T18:00:00.000000Z"}, {"uuid": "acfaa69c-a4a4-4ef0-bd7e-80d01f45cafa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28586", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260602", "content": "", "creation_timestamp": "2026-06-01T18:00:00.000000Z"}, {"uuid": "3dca076b-ec6c-46c8-94bf-130f73942d57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28578", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260602", "content": "", "creation_timestamp": "2026-06-01T18:00:00.000000Z"}, {"uuid": "a2dbb49d-aeb8-40af-8b08-2b9ca552c183", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28580", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260602", "content": "", "creation_timestamp": "2026-06-01T18:00:00.000000Z"}, {"uuid": "6a8878ab-b912-461f-aeac-61b0230c4309", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28299", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mndkvfnbjb2m", "content": "CVE-2026-28299 - SolarWinds Web Help Desk Denial-of-Service Vulnerability\nCVE ID : CVE-2026-28299\n \n Published : June 2, 2026, 7:31 p.m. | 53\u00a0minutes ago\n \n Description : SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploite...", "creation_timestamp": "2026-06-02T21:44:21.787039Z"}, {"uuid": "b5f33f7f-f934-4cf1-be40-22f6e0eaaa7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28299", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mndsmblm4g2r", "content": "\ud83d\udfe0 CVE-2026-28299 - High (8.2)\n\nSolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-28299/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-03T00:02:26.131987Z"}, {"uuid": "55d95aa3-e68a-4903-8710-3faa7471a302", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28573", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260603", "content": "", "creation_timestamp": "2026-06-02T20:00:00.000000Z"}, {"uuid": "04625cd8-9bb9-49c5-ace2-3215582e2f5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28578", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260603", "content": "", "creation_timestamp": "2026-06-02T20:00:00.000000Z"}, {"uuid": "5f1aa18f-bbeb-4716-b38a-1ec149a786d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28580", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260603", "content": "", "creation_timestamp": "2026-06-02T20:00:00.000000Z"}, {"uuid": "f025fc6c-5ad5-4b5f-9342-0e8adfc23e61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28574", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260603", "content": "", "creation_timestamp": "2026-06-02T20:00:00.000000Z"}, {"uuid": "7192f855-2c74-4063-bea6-d7e73508db2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28577", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260603", "content": "", "creation_timestamp": "2026-06-02T20:00:00.000000Z"}, {"uuid": "db78e685-c0c2-4fa9-8abe-bf72fa615891", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28581", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260603", "content": "", "creation_timestamp": "2026-06-02T20:00:00.000000Z"}, {"uuid": "f2201dc4-6e17-4d9d-9744-dc95fb98fdf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28586", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260603", "content": "", "creation_timestamp": "2026-06-02T20:00:00.000000Z"}, {"uuid": "02689618-eb40-4986-acc3-79b085f7929b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28299", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/solarwinds-security-advisory-av26-549", "content": "", "creation_timestamp": "2026-06-04T11:54:48.000000Z"}, {"uuid": "b9f811f1-8e8a-43d7-ab51-ba90a980079e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://cyber.gc.ca/en/alerts-advisories/solarwinds-security-advisory-av26-549", "content": "", "creation_timestamp": "2026-06-04T11:54:48.000000Z"}, {"uuid": "36b1ce5e-3d6a-4cb6-a1d7-96387b463f9b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28299", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mnj46oyvxu2o", "content": "\ud83d\udccc CVE-2026-28299 - SolarWinds Web Help Desk is found to be affected by a denial-of-service vulnerability, which when exploited, could cause the Web Help Desk server to c... https://www.cyberhub.blog/cves/CVE-2026-28299", "creation_timestamp": "2026-06-05T02:37:05.927133Z"}, {"uuid": "06d0a570-3628-48ba-8bc7-094128fcd6be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/6665471", "content": "2026-06-05: [CVE-2026-28318] SolarWinds Serv-U Uncontrolled Resource Consumption VulnerabilitySolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.\ncisakev", "creation_timestamp": "2026-06-05T17:46:15.513384Z"}, {"uuid": "db2110d6-530f-4ff7-bdd7-412c3b1c5b2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mnkpelghy22d", "content": "\ud83d\uded1 CVE-2026-28318\nSolarWinds Serv-U\nCVSS 7.5 / EPSS 0% / KEV\nTL;DR: SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U ser\u2026\nhttps://cvesentinel.com/report/CVE-2026-28318?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-06-05T17:53:06.327922Z"}, {"uuid": "33132aac-a004-44e2-98c5-578eaccb5cb6", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b00d5422-d924-4e37-a319-af4fa11ed523", "content": "", "creation_timestamp": "2026-06-05T18:00:02.558663Z"}, {"uuid": "e7f74639-711d-4edd-97b1-bf64df0adc2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/todb2.hugesuccess.org/post/3mnks2yssm6q2", "content": "w/r/t CVE-2026-28318 - I kinda like the mitigation guidance of \"well just block HTTP clients from sending `Content-encoding: deflate` on POSTs and you're good. Which sounded crazy to me, but is it?\n\nI know POSTs can be compressed, but I'd expect clients to use `gzip` pretty much exclusively. The [\u2026]", "creation_timestamp": "2026-06-05T18:42:19.552052Z"}, {"uuid": "3b7f448d-1160-40e1-bb3d-96ea20a93427", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/secdb.bsky.social/post/3mnkt4ofewr2o", "content": "\ud83d\udea8 CISA Adds One Known Exploited Vulnerability to Catalog (https://secdb.nttzen.cloud/security-advisory/detail/CISA-2026:0605)\n\n\u26a0\ufe0f CVE-2026-28318 - SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability\n\n\n#ZEN #SecDB #InfoSec #CISA_KEV", "creation_timestamp": "2026-06-05T19:00:14.048604Z"}, {"uuid": "3c480856-7e03-4888-a18c-cf7d2d1184c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mnkwmrimu72n", "content": "~Cisa~\nCISA added SolarWinds Serv-U vulnerability CVE-2026-28318 to its KEV catalog due to active exploitation.\n-\nIOCs: CVE-2026-28318\n-\n#CVE202628318 #SolarWinds #ThreatIntel", "creation_timestamp": "2026-06-05T20:02:55.769813Z"}, {"uuid": "f83a9a61-4c05-4b65-a84a-78f6d568bd4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mnl2oh32kk2j", "content": "CISA says attackers are exploiting SolarWinds Serv-U CVE-2026-28318 to crash exposed servers via crafted POST requests. SolarWinds has issued Hotfix 1 for the denial-of-service flaw. #SolarWinds #ServU #CISA", "creation_timestamp": "2026-06-05T21:15:26.907444Z"}, {"uuid": "214979d9-b8b2-4012-8d65-f1232de5fca8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/cyberlensai.bsky.social/post/3mnli7wttdj22", "content": "CVE watch: CVE-2026-28318: SolarWinds Serv-U \u2014 SolarWinds Serv-U Uncontrolled\u2026\n\nCheck exposure, dependency, and agent/tool access before panic-patching. Inventory beats vibes.\n\nSource: cisa.gov\nhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-28318", "creation_timestamp": "2026-06-06T01:17:52.306365Z"}, {"uuid": "1711f9c7-5bc2-4c7f-b9a7-c05fac9dbba3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/happeningnow.news/post/3mnlkspnd6i2j", "content": "CISA Adds One Known Exploited Vulnerability to Catalog\nCISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-28318 SolarWinds Serv-U Uncontrolled\u2026\n\n\ud83d\udd17 https://hnow.live/a/0ddbd4c9", "creation_timestamp": "2026-06-06T02:04:10.004367Z"}, {"uuid": "3fadff03-fd77-4674-b71a-5d82611a5d15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28318", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mnlw3fgpsz2g", "content": "\ud83d\udcf0 CISA Rilis Peringatan Darurat: Celah Keamanan SolarWinds Serv-U Eksploitasi Aktif untuk Melumpuhkan Server\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/06/06/isa-peringatkan-celah-solarwinds-serv-u-di-eksploitasi-untuk-crash-server/\n\n#cisa #cve-2026-28318 #denialOfService #ind", "creation_timestamp": "2026-06-06T05:25:51.956295Z"}, {"uuid": "9412f6ea-79b8-4d25-9925-71190687cc21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mnm77udcj4r2", "content": "CISA Warns of Exploited SolarWinds Serv-U Vulnerability The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-28318 to its Known Exploited Vulnerabilities (KEV) cata...\n\n#Cyber #Security #News #Cyber #security #news #vulnerability\n\nOrigin | Interest | Match", "creation_timestamp": "2026-06-06T08:09:30.622166Z"}, {"uuid": "f4978018-345a-4afc-bd14-5245d304f6bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mnma7l7qwd23", "content": "CISA Warns: SolarWinds Serv-U Zero-Day CVE-2026-28318 Actively Exploited \u2013 Patch Now or Face DoS Attacks! +\u00a0Video\n\nIntroduction: The SolarWinds Serv-U file transfer software, widely used for managed file transfer (MFT) across enterprises, has become the latest victim of active exploitation. CISA\u2026", "creation_timestamp": "2026-06-06T08:27:10.308468Z"}, {"uuid": "f8aefccd-dec2-43b9-8549-1aee2c1892b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mnmbo6pj2c2f", "content": "CISA added CVE-2026-28318 to KEV, citing active exploitation of a SolarWinds Serv-U DoS flaw that crashes the service via crafted unauthenticated POST requests.\n", "creation_timestamp": "2026-06-06T08:53:14.282003Z"}, {"uuid": "377d7225-6e8a-4b0f-808c-ead02cf04f21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://thehackernews.com/2026/06/cisa-adds-actively-exploited-solarwinds.html", "content": "The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity security flaw impacting SolarWinds Serv-U  multi-protocol file server software to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.\n\nThe vulnerability, tracked as CVE-2026-28318 (CVSS score: 7.5), is a denial-of-service (DoS) bug that causes the service to crash", "creation_timestamp": "2026-06-06T06:14:31.000000Z"}, {"uuid": "17d6bf0c-6ceb-4fab-a27c-07a75ccb2696", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/undercode.bsky.social/post/3mnmhldg3ph23", "content": "CISA Issues Emergency Directive: SolarWinds Serv-U Zero-Day Under Active Attack\u2014Patch by June 19! +\u00a0Video\n\nIntroduction: A critical unauthenticated Denial-of-Service (DoS) vulnerability in SolarWinds Serv-U (CVE-2026-28318) is now being actively exploited in the wild. This flaw allows any remote\u2026", "creation_timestamp": "2026-06-06T10:39:00.934094Z"}, {"uuid": "2a439f7b-1a09-4366-9d96-117572832d3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mnmhwtcigl2z", "content": "CISA added CVE-2026-28318, an actively exploited DoS flaw in SolarWinds Serv-U, to its KEV catalog. SolarWinds has released a fix in 15.5.4 HF1. #SolarWinds #ServU #CISA", "creation_timestamp": "2026-06-06T10:45:27.033749Z"}, {"uuid": "b39bfb04-e623-4ffa-a3a6-9b7712602e03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mnmicnehlv2d", "content": "SolarWinds Serv-U\u306eDoS\u8106\u5f31\u6027(CVE-2026-28318)\u304cCISA KEV\u306b\u8ffd\u52a0\u3002\u653b\u6483\u8005\u306f\u30b5\u30fc\u30d3\u30b9\u3092\u30af\u30e9\u30c3\u30b7\u30e5\u3055\u305b\u308b\u3053\u3068\u304c\u53ef\u80fd\u3002", "creation_timestamp": "2026-06-06T10:52:03.007762Z"}, {"uuid": "62133dbe-6dde-42a6-9a3e-a24cff2b008a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mnmmdgtrph2g", "content": "CISA KEV Threat Alert:\u2026\ud83d\udea8 CRITICAL CISA KEV ALERT: Threat actors are actively exploiting CVE-2026-28318, an unauthenticated Denial of Service flaw crashing internet-exposed SolarWinds Serv-U instances using malformed HTTP POST requests. Federal mandate deadlines are set.\nhttps://thecybermind.co/h1gp", "creation_timestamp": "2026-06-06T12:04:04.458992Z"}, {"uuid": "de906ebd-cbb0-4580-99f6-717309b18ad6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mnmqmciivq2w", "content": "\ud83c\udfe2 BOARD-LEVEL CYBER RISK DIRECTIVE: Executive liability, cyber insurance compliance, and corporate data sovereignty face immediate exposure via active exploitation of SolarWinds Serv-U (CVE-2026-28318). Mandatory remediation actions are required by June 19, 2026. https://thecybermind.co/7t7p", "creation_timestamp": "2026-06-06T13:20:37.034668Z"}, {"uuid": "b2ac2884-0014-471f-aa59-2f093ae8a3ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3mnmzlbasn62c", "content": "\ud83d\udea8 [CRITICAL INFRASTRUCTURE ALERT]: CVE-2026-28318\n\n\u2022 CVE ID: CVE-2026-28318\n\u2022 CVSS Score: 7.5 (High)\n\u2022 Affected: SolarWinds Serv-U \n\nhttps://securitycyber.uk", "creation_timestamp": "2026-06-06T16:01:06.361377Z"}, {"uuid": "d71c7d31-4e4f-434c-992d-b2e4be67cf78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28480", "type": "seen", "source": "https://gist.github.com/JasonCSJason/fbcd9f9c26ac2d1fe8468c7979845327", "content": "# OpenClaw \u6bcf\u65e5\u7b80\u62a5 \u2014 2026-06-06\n\n## \ud83d\udcdd \u6458\u8981\u603b\u89c8\n\n\u4eca\u5929 OpenClaw \u751f\u6001\u6700\u5927\u7684\u4e24\u4e2a\u770b\u70b9\u9ad8\u5ea6\u8026\u5408\uff1a\u4e00\u662f OpenClaw **2026.6.5 pre-release** \u5728 03:36 UTC \u843d\u5730\uff0c\u4e3b\u6253 QQBot \u63a8\u7406\u6cc4\u9732\u4fee\u590d\u3001MCP \u5de5\u5177\u7ed3\u679c\u786c\u5316\u3001Anthropic extended-thinking \u6062\u590d\u8def\u5f84\u4ee5\u53ca Parallel \u4f5c\u4e3a web_search provider \u7684\u5b98\u65b9\u63a5\u5165\uff1b\u4e8c\u662f **Microsoft Build 2026** \u4e3b\u821e\u53f0\u4e0a Microsoft \u628a\u57fa\u4e8e OpenClaw \u6846\u67b6\u6253\u9020\u7684 always-on agent **Scout** \u7aef\u5230\u4e86\u89c2\u4f17\u9762\u524d\uff0c@steipete \u4eb2\u81ea\u767b\u53f0\u3002Peter Steinberger \u540c\u6b65\u5b98\u5ba3\u52a0\u5165\u65b0\u6210\u7acb\u7684 **OpenClaw Foundation** \u6280\u672f\u6307\u5bfc\u59d4\u5458\u4f1a\uff08TSC\uff09\uff0c\u540c\u65f6\u4ecd\u6302\u7740 OpenAI \u7684\u8eab\u4efd\u3002\n\n\u793e\u533a\u5c42\u9762\u4e5f\u5f88\u70ed\u95f9\uff1a**NanoClaw** \u516c\u5f00\u628a\u77db\u5934\u5bf9\u51c6 OpenClaw \"\u8fd1 50 \u4e07\u884c\u4ee3\u7801 / 70+ \u4f9d\u8d56 / \u5171\u4eab\u5185\u5b58\" \u7684\u653b\u51fb\u9762\uff0c\u4e3b\u6253\u5bb9\u5668\u9694\u79bb\uff1b**Hermes Agent \u684c\u9762\u5e94\u7528**\u5728 6 \u6708 2 \u65e5\u4e0a\u7ebf\u3001\u51e0\u5929\u5185\u88ab\u591a\u5bb6\u81ea\u5a92\u4f53\u62ff\u6765\u8ddf OpenClaw \u5934\u5bf9\u5934\u6bd4\u8f83\uff1b\u4e2d\u6587 IME \u5728 webchat \u8f93\u5165\u5361\u987f\uff08#90800\uff09\u5df2\u5b9a\u4f4d\u5230 root cause\u3001\u4fee\u590d\u65b9\u6848\u5728\u8def\u4e0a\uff1b\u5a01\u80c1\u60c5\u62a5\u5708\u4f20\u51fa **CVE-2026-28480 allowlist bypass**\uff08CVSS 9.4\uff09\u3002\n\n## \ud83d\udd25 \u91cd\u5927\u65b0\u95fb\uff085 \u6761\uff09\n\n1. **Microsoft Scout \u5728 Build 2026 \u53d1\u5e03\uff0c\u57fa\u4e8e OpenClaw \u6846\u67b6**\u3002TechCrunch \u62a5\u9053 Scout \u662f always-on agentic \u52a9\u624b\uff0c\u8dd1\u5728 OpenClaw \u4e4b\u4e0a\uff0c\u7528\u6237\u7ed9\u81ea\u5df1\u7684\u5b9e\u4f8b\u547d\u540d\uff08\u6f14\u793a\u4e2d\u53eb \"Sebastian\"\uff09\u3002\u95e8\u69db\u662f Microsoft Frontier \u8ba1\u5212 + GitHub Copilot \u8ba2\u9605\uff0c\u8de8\u684c\u9762\u4e0e\u6d4f\u89c8\u5668\uff0c\u9884\u88c5\u65e5\u5386 / \u4f1a\u8bae\u8bae\u7a0b\u7b49\u6280\u80fd\u3002\u6700\u5173\u952e\u7684\u5dee\u5f02\u5316\u662f\u5185\u7f6e **policy conformance system**\uff0c\u6bcf\u6b21\u64cd\u4f5c\u5bf9\u7167\u7b56\u7565\u68c0\u67e5\u5e76\u4ea7\u51fa\u5ba1\u8ba1\u8f68\u8ff9\u2014\u2014\u660e\u663e\u662f\u51b2\u7740 2026 \u5e74 2 \u6708\u90a3\u6b21 \"agent \u5728\u6536\u4ef6\u7bb1\u91cc\u8dd1\u98de\" \u4e8b\u4ef6\u7684\u56de\u5e94\u3002\n2. **OpenClaw 2026.6.5 pre-release \u53d1\u5e03**\uff0819 \u5c0f\u65f6\u524d\uff09\u3002\u4fee\u590d QQBot \u628a model reasoning/thinking \u811a\u624b\u67b6\u76f4\u63a5\u6cc4\u9732\u5230\u9891\u9053\uff08#89913\u3001#90132\uff09\uff0c\u628a MCP \u7684 `resource_link`/`resource`/`audio`/\u7578\u5f62 image \u5728 materialize \u8fb9\u754c\u7edf\u4e00\u505a\u5f3a\u5236\u8f6c\u6362\u4ee5\u907f\u514d Anthropic 400 \u4e0e session \u5386\u53f2\u6c61\u67d3\uff08#90710\u3001#90728\uff09\uff0c\u5e76\u4fee\u597d\u4e86 Anthropic extended-thinking stream-start \u7684\u7ade\u6001\u4ee5\u89e6\u53d1\u65e2\u6709\u7684 recovery retry\u3002\n3. **Peter Steinberger \u53cc\u91cd\u8eab\u4efd\u6b63\u5f0f\u751f\u6548**\uff1a\u52a0\u5165 OpenClaw Foundation TSC + \u4ecd\u5728 OpenAI\u3002@TheAgentTimes 6 \u6708 6 \u65e5\u786e\u8ba4\uff1b@msdev \u5f53\u5929\u653e\u51fa \"\u5728 #MicrosoftBuild keynote \u4e0a\u53f0\u548c @steipete \u804a OpenClaw + Windows\" \u7684\u5408\u5f71\u3002Y Combinator Startup School 2026 \u4e5f\u5df2\u7ecf\u628a\u4ed6\u5217\u4e3a OpenClaw \u521b\u59cb\u4eba\u5609\u5bbe\u3002\n4. **CVE-2026-28480 OpenClaw allowlist bypass\uff08CVSS 9.4\uff09** \u88ab @threadlinqs \u4f5c\u4e3a \"THREAT INTEL\" \u63a8\u51fa\uff0c\u5ba3\u79f0\u53ef\u5728 6 \u4e2a channel \u4e0a\u52ab\u6301\u53d7\u4fe1 agent\u3002\u793e\u533a\u6682\u672a\u51fa\u73b0\u5b98\u65b9 advisory \u94fe\u63a5\uff0c\u4f46\u4e0e 2026.6.5 \u4e2d \"auth profiles \u8fc1\u5230 SQLite + \u5b98\u65b9 npm plugin install pinning\" \u7684\u786c\u5316\u65b9\u5411\u65f6\u95f4\u7ebf\u4e00\u81f4\uff0c\u503c\u5f97\u5173\u6ce8\u3002\n5. **NVIDIA SkillSpector \u5168\u9762\u94fa\u5f00**\u3002@dani_avila7 \u5ba3\u5e03 NVIDIA SkillSpector \u5df2\u5408\u5165 Claude Code Templates \u4ed3\u5e93\uff0c\u6240\u6709\u65b0 skill PR \u9ed8\u8ba4\u8d70\u8fd9\u9053\u626b\u63cf\uff1b\u8fd9\u4e5f\u662f OpenClaw 6 \u6708 1 \u65e5 ClawScan\uff08SkillSpector + \u9759\u6001\u5206\u6790 + VirusTotal\uff09\u6d41\u6c34\u7ebf\u7684\u540c\u4e00\u57fa\u7840\u8bbe\u65bd\u3002\n\n## \ud83d\udce6 \u7248\u672c\u66f4\u65b0\n\n**openclaw/openclaw 2026.6.5**\uff08pre-release\uff0c2026-06-06 03:36 UTC\uff09\n\n- QQBot \u63a8\u7406\u6cc4\u9732\u4fee\u590d\uff08#89913\u3001#90132\uff09\n- MCP \u5de5\u5177\u7ed3\u679c\u5728 materialize \u8fb9\u754c\u786c\u5316\uff0c\u8986\u76d6 resource_link / resource / audio / \u7578\u5f62 image / \u672a\u6765\u975e text/image \u5757\uff08#90710\u3001#90728\uff09\n- Anthropic extended-thinking\uff1astream-start \u7b49 `message_start` \u540e\u518d\u5224\u5b9a\uff0cprompt-cache \u8fc7\u671f\u6216 Gateway \u91cd\u542f\u540e\u80fd\u843d\u5165\u65e2\u6709 recovery retry\uff08#90667\u3001#90697\uff09\n- \u65b0 web_search provider\uff1a**Parallel**\uff08PARALLEL_API_KEY \u81ea\u53d1\u73b0\u3001guarded endpoint\u3001cache-safe session id\u3001onboarding \u9009\u62e9\u5668\u3001\u6587\u6863\u9f50\u5907 \u2014 #85158\uff09\n- Google Vertex ADC \u4fee\u590d\uff1a\u9759\u6001\u76ee\u5f55\u884c + runtime model resolution \u6062\u590d\uff0c\u5355 provider cooldown recovery \u4e0e memory-adapter \u72b6\u6001\u68c0\u67e5\u66f4\u7a33\uff08#90506\u3001#90609\u3001#90717\u3001#90816\uff09\n- Matrix\uff1avoice note preflight\u3001thread reads/replies \u5728 relations \u5206\u9875\u4e2d\u4fdd\u7559\uff08#78016\u3001#90415\uff09\n- Auth & plugin install \u6301\u4e45\u5316\uff1aauth profiles \u8fc1 SQLite\uff0c\u5b98\u65b9 npm \u63d2\u4ef6\u4fdd\u7559 trusted pin\uff0cprerelease fallback \u4e0d\u518d\u5e26 stale integrity \u8fdb\u4e0b\u4e00\u4e2a\u7248\u672c\uff08#89102\u3001#88585\uff09\n- macOS node \u6a21\u5f0f\u4e0d\u518d\u4ece\u5065\u5eb7\u76f4\u8fde Gateway \u9759\u9ed8\u5207\u8d70\uff0c\u4f34\u4fa3 App session churn \u663e\u8457\u51cf\u5c11\uff08#90668\u3001#90815\uff09\n- Cron \u65e7 JSON \u5b58\u50a8\u5728 doctor preflight \u671f\u95f4\u8fc1\u79fb\uff1bservice env \u5360\u4f4d\u7b26\u4e0d\u518d\u906e\u853d state-dir secrets\uff1bWhatsApp \u542f\u52a8\u7b49\u5f85\u9650\u65f6\uff08#90072 \u7b49\uff09\n\n\u4e3b\u65cb\u5f8b\uff1a**\u53ef\u9760\u6027 + \u5b89\u5168 + \u591a\u901a\u9053\u6253\u78e8**\uff0c\u5916\u52a0 Parallel \u8fd9\u4e00\u4e2a\u65b0 provider\u3002\n\n## \ud83d\udca5 \u793e\u5a92\u7206\u6b3e\n\n**Twitter / X \u5934\u90e8\u7ebf**\n\n- **@msdev** \u5f53\u65e5\u6700\u5177\u4f20\u64ad\u529b\u7684\u4e00\u6761\uff1a\"During the #MicrosoftBuild keynote, @steipete joined us on stage to talk all things OpenClaw and Windows\"\u2014\u2014204 likes / 4 replies\u3002\u8fd9\u6761\u662f OpenClaw \u5728 Build \u4e3b\u4f1a\u573a\u4e0a \"\u76d6\u7ae0\" \u7684\u753b\u9762\u8bc1\u636e\uff0c\u6ce8\u91ca\u91cc\u8ba8\u8bba\u96c6\u4e2d\u5728 Scout \u8d70 Entra ID\u3001\u6574\u5957\u6808\u5b8c\u5168\u8dd1\u5728 Microsoft \u5185\u90e8\u4e0a\uff0c\u5bf9 OpenClaw \u7684 \"\u975e Microsoft \u6240\u6709\" \u5b9a\u6027\u4ea7\u751f\u5206\u6b67\u3002\n- **@OmarShahine**\uff08Microsoft VP\uff0cScout \u4e3b\u63a8\u624b\uff09\u53d1\u4e86\u4e24\u6761\uff1a\u7b2c\u4e00\u6761 \"I asked Sebastian, my Microsoft Scout, what it's like to be the first Scout in the World, and to be introduced at #MicrosoftBuild\"\uff0c\u628a Scout \u62df\u4eba\u5316\u505a\u5f62\u8c61\u5305\u88c5\uff1b\u7b2c\u4e8c\u6761\u5bf9 OpenClaw Foundation \u7684\u795d\u8d3a\u2014\u2014\"It's awesome to see such talented people find new career and opportunity working for the OpenClaw foundation. The story of @openclaw is much more than just...\"\uff0c\u628a OpenAI \u6536\u4eba\u548c Foundation \u6210\u7acb\u653e\u8fdb\u540c\u4e00\u4e2a\u53d9\u4e8b\u91cc\u3002\n- **@leoobai**\uff1a\"Microsoft just unveiled Scout, a new AI assistant built on OpenClaw. Big signal: AI assistants are moving from 'chat with me' to 'help me get things done.'\"\u2014\u2014\u628a Scout \u5f53\u6210 agent \u8303\u5f0f\u4ece chat \u8d70\u5411 do \u7684\u5173\u952e\u8282\u70b9\u89e3\u8bfb\uff0c\u88ab\u591a\u4e2a\u4e8c\u521b\u8d26\u53f7\u8f6c\u53d1\u3002\n- **@itscolebennet**\uff1a\u53d1\u5e03\u5f53\u65e5\u7684\u5f00\u53d1\u8005\u4fa7\u53cd\u5e94\uff0c\"OpenClaw 2026.6.5 beta 1 is out. I like releases that make agent ops less ambiguous: fewer mystery states, clearer handoffs, better proof across tools.\"\u2014\u2014 \u5f3a\u8c03\u8fd9\u6b21\u66f4\u65b0\u5bf9 agent ops \u53ef\u89c2\u6d4b\u6027\u7684\u4ef7\u503c\u3002\n- **@dani_avila7** \u4e09\u8fde\u63a8\uff1a\"NVIDIA's Skillspector is now integrated into the Claude Code Templates repo. All new skill PRs are protected by this security scanner for AI agent skills\"\uff0c\u5e76\u9644\u4e0a PR \u8f93\u51fa\u622a\u56fe\u548c NVIDIA/SkillSpector \u4ed3\u5e93\u94fe\u63a5\u3002\u8fd9\u662f OpenClaw 6 \u6708 1 \u65e5\u53d1\u5e03\u7684 ClawScan \u6d41\u6c34\u7ebf\u5728\u66f4\u5e7f agent skill \u751f\u6001\u7684 \"\u5916\u6ea2\" \u8bc1\u636e\u3002\n- **@vigilcodes**\uff1a\"VIGIL is now live across the agent ecosystem \ud83d\udee1\ufe0f Merged into ClawHub. 11 read-only security tools. any agent can scan before it signs.\"\u2014\u2014\u4e00\u7ec4 11 \u4ef6\u5957\u53ea\u8bfb\u5b89\u5168\u5de5\u5177\u4e0a\u67b6 ClawHub\uff0c\u628a OpenClaw \u7684 skill \u751f\u6001\u8fdb\u4e00\u6b65\u63a8\u5411 \"\u7b7e\u524d\u81ea\u68c0\" \u7684\u5b89\u5168\u60ef\u4f8b\u3002\n- **@threadlinqs**\uff1a\u8d1f\u9762\u51b2\u51fb\u6e90\u3002\"THREAT INTEL: OpenClaw allowlist bypass (CVE-2026-28480, CVSS 9.4) hijacks trusted AI agents across 6 channels.\"\u2014\u2014\u7ec6\u8282\u5c1a\u672a\u5728\u5b98\u65b9 advisory \u51fa\u73b0\uff0c\u503c\u5f97\u540e\u7eed\u8ddf\u8e2a\u3002\n- **@conoro** \u662f\u4eca\u5929\u6700\u5177\u4f53\u7684 \"\u7528\u6237\u771f\u5b9e\u4ef7\u503c\" \u6848\u4f8b\uff1a\"Real valuable win from an @openclaw automation. I've had it watching eBay for cheap RTX3060 cards without much luck. This week I got it to monitor @vinted...\"\u2014\u2014\u4e00\u6761\u5e73\u5b9e\u7684\u7701\u94b1\u6545\u4e8b\uff0c\u88ab\u591a\u4e2a\u56fd\u5bb6\u7684\u5c0f\u8d26\u53f7\u8f6c\u53d1\uff0c\u6bd4\u4efb\u4f55 \"agent \u6539\u53d8\u4e16\u754c\" \u7684\u53e3\u53f7\u90fd\u6253\u52a8\u4eba\u3002\n- **@palewire**\uff08Ben Welsh\uff0c\u8bb0\u8005\uff09\uff1a\"My screwy OpenClaw launched a new news app.\"\u2014\u2014OpenClaw \u5728\u65b0\u95fb\u4e1a\u6d41\u6c34\u7ebf\u91cc\u6084\u6084\u51fa\u73b0\u7684\u5c0f\u4f8b\u5b50\uff1b\"screwy\" \u8fd9\u4e2a\u7528\u8bcd\u4ee3\u8868\u7528\u6237\u771f\u5b9e\u5730\u628a OpenClaw \u5f53\u6210 \"\u4e0d\u5b8c\u7f8e\u4f46\u53ef\u6539\" \u7684\u5de5\u5177\u3002\n- **@alex**\uff1a\"openclaw, i do not miss u at this pt in time.\"\u2014\u2014885 \u6d4f\u89c8\u7684\u8d1f\u9762\u77ed\u53e5\uff0c\u63d0\u793a churn \u4e5f\u5728\u53d1\u751f\u3002\n- \u4e2d\u6587\u5708\uff1a**@linglingfa** \u63d0\u9192 \"OpenClaw \u8fd9\u79cd\u8f6f\u4ef6\u6562\u8ba9\u522b\u4eba\u52a8\u624b\u4ee3\u529e\uff0c\u53ea\u89c9\u5f97\u6bdb\u9aa8\u609a\u7136\"\uff0c\u53cd\u5bf9\u628a\u4ee3\u88c5\u670d\u52a1\u5356\u7ed9\u5c0f\u767d\u7528\u6237\uff0c\u662f\u8fd9\u6ce2 Build \u6d41\u91cf\u8fdb\u5165\u4e2d\u6587\u793e\u7fa4\u7684\u526f\u4f5c\u7528\u3002\n- **@DWFLabs**\uff1a\"OpenClaw is the clearest contrast, with its ClawHub marketplace hosting numerous community plugins, including self-improvement related skills.\"\u2014\u2014 \u628a ClawHub \u89c6\u4e3a OpenClaw \u533a\u522b\u4e8e Hermes \u7684\u62a4\u57ce\u6cb3\u3002\n\n**Reddit r/openclaw \u70ed\u5e16\uff08\u8fd1 24 \u5c0f\u65f6\uff09**\n\n- *Killer use case* (1ty5f4l)\uff1a\u7528\u6237\u5217\u4e3e OpenClaw \"\u6e05\u6536\u4ef6\u7bb1\u3001\u53d1\u90ae\u4ef6\u3001\u7ba1\u65e5\u5386\u3001\u529e\u767b\u673a\"\uff0c\u8bc4\u8bba\u533a\u6f14\u5316\u6210 \"\u6211\u7528 OpenClaw \u8dd1\u4e86\u4ec0\u4e48\u7701\u94b1\u573a\u666f\" \u7684 show & tell\u3002\n- *Open AI sign-in = security risk?* (1tyjebc)\uff1a\u8d28\u7591 OpenAI \u767b\u5f55\u662f\u4e0d\u662f\u628a\u4fe1\u4efb\u9762\u6269\u5927\uff1b\u8bc4\u8bba\u533a\u4e3b\u6d41\u56de\u590d\u6307\u5411 2026.6.5 \u628a auth profile \u79fb\u5230 SQLite \u8fd9\u6761\u66f4\u65b0\u3002\n- *Best local Ollama model for OpenClaw tool use with ~12GB RAM* (1tyhge7)\uff1a\u672c\u5730\u6a21\u578b + tool-use \u53ef\u9760\u6027\u7684\u786c\u521a\u95ee\u9898\uff0cOmniCoder2 \u88ab\u591a\u4eba\u63a8\u8350\u4e3a\u5f53\u524d 12GB \u6863\u6700\u7a33\u3002\n- *Brand new install problems with Ollama Cloud Models* (1tykb8a)\uff1aclean install \u5728 Mac mini \u4e0a\u4ecd\u5361\uff0c\u91cd\u73b0\u7387\u63d0\u793a\u5b89\u88c5\u8def\u5f84\u8fd8\u6709\u7c97\u7cd9\u8fb9\u7f18\u3002\n- *Has there been a breaking change with openai OAuth?* (1ty66jv)\uff1a\u9ad8\u8d5e\u56de\u590d\u6307\u51fa \"\u4f60\u6062\u590d\u7684\u5907\u4efd\u91cc\u5f88\u53ef\u80fd\u542b\u5df2\u7528\u8fc7\u7684 Codex OAuth refresh token\uff0c\u6216\u8005\u591a\u4e2a OpenClaw/Codex harness \u8fdb\u7a0b\u5728\u5237\u65b0\u540c\u4e00\u4e2a profile\"\u2014\u2014\u8fd9\u6761\u5177\u4f53\u8bca\u65ad\u672c\u8eab\u5df2\u88ab\u6536\u5165\u793e\u533a FAQ\u3002\n- *Showcase Weekend! \u2014 Week 22, 2026* (1ty7xnq)\uff1a\u6bcf\u5468\u56fa\u5b9a\u7684\u4f5c\u54c1\u79c0\uff0c\u672c\u5468\u4eae\u70b9\u96c6\u4e2d\u5728 multi-channel + \u957f\u4efb\u52a1 cron \u7f16\u6392\u3002\n\n**Hacker News\uff0824 \u5c0f\u65f6\uff09**\n\n- *Microsoft launches Scout, an OpenClaw-inspired personal assistant*\uff08TechCrunch\uff0cHN id 48425945\uff09\uff1a3 points / 1 comment\u2014\u2014HN \u4e0a\u5bf9\u8fd9\u4e2a\u65b0\u95fb\u7684\u70ed\u5ea6\u5e76\u4e0d\u9ad8\uff0c\u8bba\u575b\u4e3b\u6d41\u8bc4\u8bba\u51b7\u9759\u5730\u6307\u51fa \"Scout \u628a OpenClaw \u5305\u8fdb Microsoft \u4fe1\u4efb\u8fb9\u754c\uff0c\u4f46\u4e0d\u662f Microsoft \u81ea\u5df1\u9020\u51fa\u6765\u7684\"\u3002\n- *Every AI Agent Feature Is a Cache Invalidation Surface*\uff08openclacky.com\uff09\uff1a2 points / 0 comments\uff0c\u5de5\u7a0b\u89d2\u5ea6\u7684\u4e00\u7bc7 cache \u5931\u6548 + agent \u601d\u8003\u7684\u968f\u7b14\uff0c\u6587\u7ae0\u5728\u7528 OpenClaw \u7684 URL \u98ce\u683c\u505a\u9690\u55bb\uff0c\u5e76\u4e0d\u662f\u5b98\u65b9\u6587\u3002\n- *Hermes \u2013 Community Web UI with Agent*\uff08get-hermes.ai\uff09\uff1a6 \u6708 6 \u65e5 19:16 UTC \u4e0a\u699c\uff0c\u786e\u8ba4 Hermes \u73b0\u5728 HN \u4e0a\u540c\u6837\u6709\u58f0\u91cf\u3002\n- *Why Aren't We Measuring How AI Affects Humans?*\uff08IEEE Spectrum\uff09\uff1a22:54 UTC \u4e0a\u699c\uff0c\u80cc\u666f AI \u653f\u7b56\u8ba8\u8bba\u5728\u5347\u6e29\u3002\n\n\u793e\u533a\u60c5\u7eea\u6574\u4f53\u503e\u5411\uff1a\"**Build \u4e0a\u7684\u76d6\u7ae0 + 2026.6.5 \u5b9e\u8d28\u5185\u5bb9 + Foundation \u843d\u5b9a**\" \u5f62\u6210\u6b63\u5faa\u73af\uff0c\u4f46 CVE-2026-28480 \u4e0e NanoClaw \u7684 \"isolation \u4e0d\u591f\" \u653b\u51fb\u662f\u8fd9\u5468\u7684\u4e24\u6839\u53cd\u5411\u652f\u67f1\u3002\n\n## \ud83d\udc26 \u4eba\u7269\u52a8\u6001\n\n- **Peter Steinberger / @steipete**\uff1a\u8eab\u4efd\u5207\u6362\u5230 \"Polyagentmorous ClawFather. Came back from retirement to mess with AI and help a lobster take over the world. @OpenClaw\ud83e\udd9e + @OpenAI\"\u3002\u5f53\u524d 534k \u5173\u6ce8\u300114 \u4e07\u53d1\u63a8\u3002\u4eca\u65e5\u52a8\u4f5c\uff1a\u767b Build keynote\u3001\u52a0\u5165 OpenClaw Foundation TSC\u3001@Striatum_ai \u900f\u9732\u4ed6\u7ee7\u7eed dependency purge \u2014\u2014 \u7528 photon\uff08Rust \u7f16\u51fa\u7684 WebAssembly\uff09\u66ff\u6362 Sharp \u548c Jimp\u3002\n- **@OpenClaw \u5b98\u53f7**\uff1a539k \u5173\u6ce8\u3001777 \u6761\u63a8\u6587\uff08\u5c11\u800c\u7cbe\uff09\u3002\u7b80\u4ecb\u66f4\u65b0\u4e3a \"New shell, same lobster soul\"\u3002\n- **@OmarShahine**\uff1a\u628a Scout \u62df\u4eba\u5316\u63a8\u5411\u5927\u4f17\uff0c\u5e76\u5728 OpenClaw Foundation \u6210\u7acb\u65f6\u516c\u5f00\u7ad9\u53f0\u3002\n- **Andrej Karpathy / @karpathy**\uff1a\u4eca\u5929\u6ca1\u6709\u76f4\u63a5 OpenClaw \u5185\u5bb9\uff0c\u4f46 @raunak_yadush \u628a \"@steipete = built openclaw\" \u5217\u5165 \"AI \u5fc5\u5173\u6ce8 15 \u4eba\" \u540c\u540d\u699c\u5355\uff0c\u4e0e karpathy \u540c\u5217\u3002\n- **@kilocode**\uff1a\"3M+ Kilo Coders. Open source since day one!\"\u2014\u2014\u540c\u751f\u6001\u53e6\u4e00\u4e2a\u5f00\u6e90 agent \u5e73\u53f0\uff0c\u6b63\u5728\u62a2 dev \u5fc3\u667a\u4efd\u989d\u3002\n\n## \ud83d\udee0 GitHub\n\n- **openclaw/openclaw 2026.6.5 pre-release**\uff1a\u89c1\u4e0a\u3002\n- **Issue #90800\uff08\u4e2d\u6587 IME \u5728 webchat \u8f93\u5165\u5361\u987f\uff09**\uff1awebchat Control UI\uff08local gateway :18432\uff09\uff0cChrome / Safari\u3001macOS \u590d\u73b0\u3002Root cause\uff1atextarea auto-resize handler \u5728\u6bcf\u4e2a `input` \u4e8b\u4ef6\u4e2d\u540c\u6b65\u89e6\u53d1\u5e03\u5c40\u56de\u6d41\uff08scrollHeight \u8bfb + style.height \u5199\uff09\u3002\u4e2d\u6587 IME \u5728 composition \u671f\u95f4\u6bcf\u4e2a\u62fc\u97f3\u952e\u90fd\u89e6\u53d1 input\uff0c\u5bfc\u81f4\u6bcf\u5e27\u591a\u6b21\u5f3a\u5236 reflow\uff0c\u963b\u585e IME composition \u7ebf\u7a0b\uff0c\"\u5e02\u573a\" \u8fd9\u79cd\u5b57\u5ef6\u8fdf\u53ef\u89c1\u3002\u5efa\u8bae\u65b9\u6848\uff1a\u7528 `requestAnimationFrame` \u628a resize \u5408\u5e76\u5230\u4e00\u5e27\u4e00\u6b21\u3002Reporter \u6ce8\u91ca\uff1aDeepFund\uff08\u57fa\u4e8e OpenClaw \u7684 agent\uff09\u5df2\u7ecf\u8e29\u8fc7\u540c\u4e00\u4e2a\u5751\u5e76\u4fee\u8fc7\u3002\u5f53\u524d 2026.6.5 highlights \u4e2d\u672a\u5305\u542b\u6b64\u4fee\u590d\u3002\n- **openclaw/clawhub**\uff1askill / plugin registry\uff0c\u4eca\u65e5\u91cd\u70b9\u662f ClawScan + SkillSpector + VirusTotal \u4e09\u4ef6\u5957\u5df2\u6210\u4e3b\u7ebf\u3002\n- **CherryHQ/cherry-studio #15726**\uff1a\u7b2c\u4e09\u65b9 Cherry Studio \u4e0d\u80fd\u81ea\u52a8\u66f4\u65b0\u5185\u7f6e OpenClaw \u96c6\u6210\uff0c\u793e\u533a\u547c\u5401 \"\u624b\u52a8 / \u81ea\u52a8\u66f4\u65b0\u652f\u6301\"\u3002\n- **freddy-schuetz/n8n-claw**\uff1an8n \u628a\u7f16\u7801\u4efb\u52a1\u59d4\u6258\u7ed9 OpenClaw \u7684\u793e\u533a\u96c6\u6210\u3002\n- **volcengine/OpenViking**\uff1a\u706b\u5c71\u5f15\u64ce\u5f00\u6e90\u3001\u4e13\u4e3a AI Agent\uff08\u660e\u786e\u70b9\u540d OpenClaw\uff09\u505a\u7684 context \u6570\u636e\u5e93\uff1b\u7edf\u4e00\u7ba1\u7406 memory / context\u3002\n- **openagents-org/openagents**\uff1a\"Any agent, one workspace \u2014\u2014 \u628a Claude Code\u3001OpenClaw\u3001Codex CLI\u3001Cursor \u63a5\u5230\u540c\u4e00\u4e2a workspace \u5171\u4eab context\"\u3002\n\n## \u2694\ufe0f \u7ade\u54c1\n\n- **NanoClaw\uff08nanocoai/nanoclaw\uff09**\uff1a\u81ea\u6211\u5b9a\u4f4d \"OpenClaw \u7684\u8f7b\u91cf\u66ff\u4ee3\u54c1\uff0c\u8dd1\u5728\u5bb9\u5668\u91cc\u4ee5\u6c42\u5b89\u5168\"\u3002\u5176\u63a8\u5e7f\u6587\u6848\u76f4\u63a5\u653b\u51fb OpenClaw \"\u8fd1 50 \u4e07\u884c\u4ee3\u7801 / 53 \u914d\u7f6e\u6587\u4ef6 / 70+ \u4f9d\u8d56\u3002\u5b89\u5168\u9760 application level\uff08allowlist\u3001\u914d\u5bf9\u7801\uff09\uff0c\u800c\u4e0d\u662f\u771f\u6b63\u7684 OS \u7ea7\u9694\u79bb\u3002\u6240\u6709\u4e1c\u897f\u8dd1\u5728\u4e00\u4e2a Node \u8fdb\u7a0b\u91cc\u3001\u5171\u4eab\u5185\u5b58\"\u3002NanoClaw \u628a Claude agent \u8dd1\u5728\u4e13\u7528 Linux \u5bb9\u5668\u91cc\u3001\u7528 `bash nanoclaw.sh` \u4e00\u6761\u547d\u4ee4\u81ea\u4e3e\uff08\u81ea\u52a8\u88c5 Node\u3001pnpm\u3001Docker\uff0c\u767b\u8bb0 Anthropic \u51ed\u636e\uff0c\u8fde\u63a5 Telegram/Discord/WhatsApp/CLI \u901a\u9053\uff0c\u5931\u8d25\u65f6\u81ea\u52a8\u8c03 Claude Code \u8bca\u65ad\uff09\u3002\u57fa\u4e8e Anthropic Agents SDK\uff0cchannel \u8986\u76d6 WhatsApp / Telegram / Slack / Discord / Gmail\uff0c\u542b memory + scheduled jobs\u3002\n- **Hermes Agent**\uff08Nous Research\uff09\uff1a6 \u6708 2 \u65e5\u53d1\u684c\u9762\u5e94\u7528 v0.15.2 public preview\uff0c\u652f\u6301 macOS / Windows / Linux\u3002Medium \u6587\u7ae0\u5ba3\u79f0 \"\u4e0a\u7ebf 4 \u4e2a\u6708\u5c31 18 \u4e07 + GitHub stars\uff0c2026 \u589e\u901f\u6700\u5feb\u7684\u5f00\u6e90 agent \u6846\u67b6\"\uff0c\u5e76\u628a Hermes \u4e0e OpenClaw \"374k+ stars\" \u5bf9\u6bd4\uff1b\u81ea\u6211\u5b9a\u4f4d\u662f stateful + self-improving\uff0cpost-task evaluation \u62bd\u79bb\u63a8\u7406\u8303\u5f0f\u6210 Markdown skill \u6587\u4ef6\uff08SQLite FTS + LLM summarization\uff09\uff0c\u58f0\u79f0 20+ \u81ea\u521b skill \u540e\u7c7b\u4f3c\u4efb\u52a1\u5feb 40%\uff08TokenMix benchmark, Apr 2026\uff09\u3002\u6700\u5927\u5dee\u5f02\u70b9\uff1a**Hermes \u81ea\u5e26\u4e00\u624b GUI \u684c\u9762 App\uff1bOpenClaw \u4ecd\u4ee5 gateway / \u591a channel \u4e3a\u4e3b\u8f74**\u3002\n- **Microsoft Scout**\uff1a\u88ab\u5b9a\u4f4d\u4e3a OpenClaw \u5728\u4f01\u4e1a\u5185\u7684 \"\u53d7\u63a7\u7248\u672c\"\u2014\u2014audit trail + Entra ID + Frontier \u8ba1\u5212\u95e8\u69db\uff1b\u4fa7\u9762\u627f\u8ba4 OpenClaw \u6846\u67b6\u7684\u6709\u6548\u6027\u3002\n- **Devin Desktop**\uff08\u539f Windsurf\uff09\uff1a\u521a\u521a\u5ba3\u5e03\u4ece Windsurf \u6539\u540d\u4e3a Devin Desktop\uff0c\u5e76\u5bf9\u5916\u5f00\u653e **ACP\uff08Agent Client Protocol\uff09**\u2014\u2014\u4efb\u4f55 ACP \u517c\u5bb9 agent \u90fd\u80fd\u63d2\u8fdb Devin Desktop\uff0cDevin Desktop \u4e5f\u80fd\u4f5c\u4e3a host \u62c9\u8d77\u4efb\u4f55 ACP agent\u3002\u8fd9\u662f\u76f4\u63a5\u51b2 OpenClaw \"\u628a\u4efb\u4f55 agent \u63a5\u5230\u4efb\u4f55 channel\" \u7684\u5b9a\u4f4d\u3002\n- **WeSight**\uff1a\u684c\u9762 AI Agent workspace\uff0c\u4e3b\u6253 \"\u5728\u4e00\u4e2a\u53ef\u89c6\u5316 App \u91cc\u540c\u65f6\u8dd1 Claude Code\u3001Codex\u3001OpenClaw\u3001Hermes\"\uff0c\u628a OpenClaw \u5f53\u4f5c\u5176\u4e2d\u4e00\u79cd agent runtime\u3002\n\n## \ud83c\udf10 \u884c\u4e1a\n\n- **OpenRouter** \u516c\u5f00\u7ef4\u62a4 \"Top AI Models Used by OpenClaw\" collection\uff0cOpenClaw \u5df2\u7ecf\u6210\u4e3a OpenRouter \u7684\u53ef\u53d1\u73b0\u4f7f\u7528\u7c7b\u76ee\u3002\n- **Hostinger hPanel** \u628a OpenClaw \u5217\u4e3a\u4e00\u952e\u5e94\u7528\uff1b**Umbrel App Store** \u540c\u6837\u4e0a\u67b6\u3002\n- **roadmap.sh** \u63a8\u51fa \"How to Install OpenClaw\" \u6307\u5357\u4e0e \"Claude Code vs Cursor\" \u5bf9\u6bd4\u9875\uff0cOpenClaw \u5df2\u662f roadmap \u7684\u5e38\u9a7b\u6761\u76ee\u3002\n- **The New Stack**\uff1a\u518d\u8d77 \"OpenClaw used Gavriel Cohen's code and exposed the AI Agent accountability problem\" \u65e7\u95fb\u2014\u2014\u5f00\u53d1\u8005\u53d1\u73b0\u81ea\u5df1\u7684\u4ee3\u7801\u51fa\u73b0\u5728 OpenClaw \u4e2d\u3001\u5f15\u51fa agent \u6846\u67b6\u7684\u4ee3\u7801 attribution \u95ee\u9898\uff1b\u672c\u5468\u4ecd\u7136\u5728\u88ab\u591a\u5bb6\u81ea\u5a92\u4f53\u590d\u7528\uff0c\u662f\u60ac\u800c\u672a\u51b3\u7684\u8206\u60c5\u98ce\u9669\u3002\n- **AI Engineer @aiDotEngineer**\uff1a\"OpenClaw hit 3,000 commits in a single day. 10 to 15 maintainers. All with day jobs. @vincent_koc (Chief Architect of OpenClaw) explains how the factory\u2026\"\u2014\u2014\u628a OpenClaw \u7684\u9ad8\u541e\u5410\u8d21\u732e\u6d41\u7a0b\u4f5c\u4e3a\u53ef\u501f\u9274 OSS \u8303\u672c\u3002\n- **Memori Labs**\uff1a\u5ba3\u4f20 \"Memori + OpenClaw \u7ed9 agent \u8de8 session/workflow \u6301\u4e45\u8bb0\u5fc6\" \u7684\u7ec4\u5408\u5356\u6cd5\uff0c\u662f\u7b2c\u4e09\u65b9 memory \u5c42\u4e0e OpenClaw \u96c6\u6210\u7684\u4ee3\u8868\u6848\u4f8b\u3002\n- **YouTube \u751f\u6001**\uff1a\u4eca\u65e5\u76f8\u5173\u89c6\u9891\u6db5\u76d6 \"OpenClaw just got way easier\"\uff08Forward Future\uff0c\u4e0e Perplexity Computer \u8054\u52a8\uff09\u3001\"Codex vs Claude Code vs OpenClaw\"\u3001\"AI Agents for Home Assistant: OpenClaw vs Hermes\"\uff0c\u5a31\u4e50\u5316\u5185\u5bb9\u4e5f\u5728\u5927\u91cf\u4ea7\u51fa\u3002\n", "creation_timestamp": "2026-06-06T23:13:33.000000Z"}, {"uuid": "5b8d5360-194b-42a2-bd3f-e4a120e99484", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mnpgzkbfl426", "content": "CISA adds critical SolarWinds Serv-U vulnerability (CVE-2026-28318) to KEV catalog. Immediate patching required to prevent active exploitation. #CyberSecurity #SolarWinds #CISA #Vulnerability Link: thedailytechfeed.com/critical-sol...", "creation_timestamp": "2026-06-07T15:07:03.584335Z"}, {"uuid": "9726d901-2b13-4ace-8b9e-c4bdc4ecbf8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mnq7dh3jxn2c", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30921\u4ef6\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 \n\nCISA Adds One Known Exploited Vulnerability to Catalog  #CISA (Jun 5)\n\nCVE-2026-28318 SolarWinds Serv-U\u306e\u30ea\u30bd\u30fc\u30b9\u6d88\u8cbb\u5236\u5fa1\u4e0d\u80fd\u306e\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "creation_timestamp": "2026-06-07T22:22:04.707260Z"}, {"uuid": "06cb157d-d26e-4001-b18f-4ead979a171c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mnrc5xywyb2n", "content": "CISA says attackers are exploiting a patched SolarWinds Serv-U flaw, CVE-2026-28318, via crafted POST requests that can crash the service. SolarWinds urges immediate upgrades. #SolarWinds #ServU #CISA", "creation_timestamp": "2026-06-08T08:45:22.707052Z"}, {"uuid": "b79e6f27-6721-4ca3-a0c6-26296dea2f67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://www.acn.gov.it/portale/w/solarwinds-sfruttamento-attivo-in-rete-della-cve-2026-28318", "content": "", "creation_timestamp": "2026-06-08T01:15:34.000000Z"}, {"uuid": "930b0cf0-cc35-4336-8b30-4c1c0fbaa18c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mnriaosjtc2r", "content": "CISA has added the critical SolarWinds Serv-U vulnerability (CVE-2026-28318) to its Known Exploited Vulnerabilities catalog, warning of active exploitation. This Uncontrolled Resource Consumption flaw allows unauthenticated attackers to crash the service via malicious HTTP requests.", "creation_timestamp": "2026-06-08T10:34:15.456227Z"}, {"uuid": "9e457c08-37c4-46ea-8847-5088cf541fc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/exiledev8668.bsky.social/post/3mnrhzqdldv2n", "content": "CISA flags SolarWinds Serv-U DoS (CVE-2026-28318) as actively exploited. The patch is table stakes. The real question: what privileged accounts are attached to that server, and does anyone actually know?", "creation_timestamp": "2026-06-08T10:30:22.134390Z"}, {"uuid": "70a4494c-68ae-44e7-8afb-f440bbef2676", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mnri7ugsqs2g", "content": "CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318)\n\n\ud83d\udcd6 REad more: www.helpnetsecurity.com/2026/06/08/c...\n\n#enterprise #filetransfer #government #vulnerability #cybersecurity #cybersecuritynews", "creation_timestamp": "2026-06-08T10:33:53.311296Z"}, {"uuid": "510f77e5-a67e-4a58-a836-a39f9976f270", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mnrmrxgm4c24", "content": "CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318)\n\nwww.helpnetsecurity.com/2026/06/08/c...\n\n#Kyberturvallisuus #LaajaVaikutus #Haavoittuvuus", "creation_timestamp": "2026-06-08T11:55:33.983325Z"}, {"uuid": "e55a0f96-d614-428d-a049-e94a6c802e9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mns2gxazjf2l", "content": "\ud83d\udce2 CISA KEV ALERT! An actively exploited DoS flaw (CVE-2026-28318) in SolarWinds Serv-U is on the loose. Federal agencies must patch by June 19. All orgs using Serv-U are urged to update immediately! \ud83d\udea8 #CVE #SolarWinds #Infosec #PatchNow\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-06-08T15:59:53.875852Z"}, {"uuid": "91995b92-e6ce-4a88-a671-26bd73319dc1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116715315438520529", "content": "\ud83d\udcf0 CISA Mandates Patch for Actively Exploited SolarWinds DoS Flaw Added to KEV Catalog\n\ud83d\udce2 CISA KEV ALERT! An actively exploited DoS flaw (CVE-2026-28318) in SolarWinds Serv-U is on the loose. Federal agencies must patch by June 19. All orgs using Serv-U are urged to update immediately! \ud83d\udea8 #CVE #SolarWinds #Infosec #PatchNow\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisa-orders-patch-for-actively-exploited-solarwinds-serv-u-dos-vulnerability/?utm_\u2026", "creation_timestamp": "2026-06-08T15:59:54.265788Z"}, {"uuid": "866406c7-59fc-408f-a12d-bf8dace593c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28372", "type": "seen", "source": "https://bsky.app/profile/linux.activitypub.awakari.com.ap.brid.gy/post/3mnsaminkqub2", "content": "Ubuntu 26.04 LTS Inetutils Critical Privilege Escalation DoS CVE-2026-28372 Several security issues were fixed in Inetutils.\n\n#Ubuntu #Linux #Distribution #- #Security #Advisories\n\nOrigin | Interest | Match", "creation_timestamp": "2026-06-08T17:51:03.653164Z"}, {"uuid": "7942e281-bfae-4efe-889d-6441be594e98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3mnsasfnyob22", "content": "CISA Orders Serv-U CVE-2026-28318 Patch After Active Exploitation SolarWinds patches actively exploited Serv-U DoS bug CVE-2026-28318 while CISA adds it to the KEV catalog and orders remediation at...\n\n#Resources #CVE #Vulnerability #Alerts [\u2026] \n\n[Original post on dailysecurityreview.com]", "creation_timestamp": "2026-06-08T17:53:40.941807Z"}, {"uuid": "f107e935-655a-4a76-bd4c-8650a6cc0f3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mnswpy24f52o", "content": "CISA\uff1a\u30d1\u30c3\u30c1\u306b\u3088\u308aSolarWinds Serv-U\u306eDoS\u8106\u5f31\u6027\uff08CVE-2026-28318\uff09\u304c\u60aa\u7528\u3055\u308c\u307e\u3057\u305f \n\nCISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318)  #HelpNetSecurity (Jun 8)\n\nwww.helpnetsecurity.com/2026/06/08/c...", "creation_timestamp": "2026-06-09T00:26:01.534383Z"}, {"uuid": "2ab523b1-72bd-4fff-9874-12acb1b8739d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28164", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117128077414913778", "content": "CVE-2026-28164: CRITICAL CSRF in HashThemes Easy Elementor Addons \u22642.3.7. Remote attackers can exploit this for full user compromise. No patch yet \u2014 track vendor advisories. CVSS 9.6. https://radar.offseq.com/threat/cve-2026-28164-cwe-352-cross-site-request-forgery-csrf-in-hashthemes-easy-elementor-addons-7bfb9b1be22a1e31 #OffSeq #WordPress #CSRF #CVE2026_28164", "creation_timestamp": "2026-08-20T13:30:27.240102Z"}, {"uuid": "a70b416f-f7af-4c6d-9f6d-8894235f6109", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28164", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mtje4yqmmv2n", "content": "CRITICAL CSRF vulnerability (CVE-2026-28164) in HashThemes Easy Elementor Addons \u22642.3.7 lets attackers execute actions as users. No patch yet \u2014 monitor vendor for updates. https://radar.offseq.com/threat/cve-2026-28164-cwe-352-cross-site-request-forgery-csrf-in-hashthemes-easy-elementor-addons-7b...", "creation_timestamp": "2026-08-20T13:30:29.165087Z"}, {"uuid": "8021388a-ade0-41ae-93fc-7dd0f9870a3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mnszl2qolk2h", "content": "CISA: Patch actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318)\n\nA vulnerability (CVE-2026-28318) that can be exploited to crash SolarWinds Serv-U file transfer servers is being leveraged by attackers in the wild, the US Cybersecurity and Infrastructure Securit\u2026\n#hackernews #news", "creation_timestamp": "2026-06-09T01:16:57.375010Z"}, {"uuid": "e6cbafe0-ebd5-4756-841c-ce22469b9455", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/-SvGncDmyD8mCinZhEuoCdd-YFQP5dpOrLuNh1m61f7bY1jo", "content": "", "creation_timestamp": "2026-08-22T07:00:02.908687Z"}, {"uuid": "1788e3af-cbe4-4545-ad95-cf566f13478c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28672", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msvkyosmvz26", "content": "CVE-2026-28672 - apache ranger\nApache Ranger versions 0.6 to 2.8 are vulnerable to an issue where an attacker can execute arbitrary operating system commands by manipulating the username. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apacheranger #apachefoundation #CVE #infosec", "creation_timestamp": "2026-08-12T16:40:05.464112Z"}, {"uuid": "20737b75-3565-47a5-846f-582529d51dee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28164", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtjgdlg5vl25", "content": "\ud83d\udea8 CVE-2026-28164 \u2014 CVSS 9.6 CRITICAL\n\nCross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Reque...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-28164\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-20T14:09:56.890340Z"}, {"uuid": "21d9e792-5c1b-4bc5-9a2c-9507ba6734ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28318", "type": "seen", "source": "https://bsky.app/profile/intelnightowl.bsky.social/post/3mntqv2em7u2d", "content": "US face SolarWinds Serv\u2011U DoS exploit CVE-2026-28318; patch deadline June 19 underscores #USA threat posture #UN #CyberSecurity #TechPolicy https://www.helpnetsecurity.com/2026/06/08/cisa-patch-actively-exploited-solarwinds-serv-u-dos-vulnerability-cve-2026-28318/", "creation_timestamp": "2026-06-09T08:14:09.032055Z"}, {"uuid": "ba55f30b-876e-4b86-8a43-9914991e8056", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28318", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mntyinmzox2t", "content": "\ud83d\udce2 CVE-2026-28318 : vuln\u00e9rabilit\u00e9 DoS dans SolarWinds Serv-U exploit\u00e9e activement\n\ud83d\udcdd ## \ud83d\uddd3\ufe0f Contexte\n\nSource : SecurityWeek, publi\u00e9 le 8 juin 2026.\nhttps://cyberveille.ch/posts/2026-06-09-cve-2026-28318-vulnerabilite-dos-dans-solarwinds-serv-u-exploitee-activement/ #CISA_KEV #Cyberveille", "creation_timestamp": "2026-06-09T10:30:28.424604Z"}, {"uuid": "7b577565-b3ff-4011-964b-b6da624c260f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28164", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtjhhkmksj23", "content": "CVE-2026-28164 - easy elementor addons\nThe Easy Elementor Addons add\u2011on for WordPress (versions up to 2.3.7) can be tricked into performing actions without the site owner\u2019s permission. This could let a malicious\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#hashthemes #CVE #infosec", "creation_timestamp": "2026-08-20T14:30:04.644393Z"}, {"uuid": "787755c4-48b5-4f4b-8f0f-799d35f962e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/116720911179613526", "content": "\ud83d\udcf0 CISA Mandates Patch for Actively Exploited SolarWinds DoS Flaw Added to KEV Catalog\n\ud83d\udce2 CISA KEV ALERT! An actively exploited DoS flaw (CVE-2026-28318) in SolarWinds Serv-U is on the loose. Federal agencies must patch by June 19. All orgs using Serv-U are urged to update immediately! \ud83d\udea8 #CVE #SolarWinds #Infosec #PatchNow\n\ud83c\udf10 cyber[.]netsecops[.]io\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisa-orders-patch-for-actively-exploited-solarwinds-serv-u-dos-vulnerability/?utm_\u2026", "creation_timestamp": "2026-06-09T15:43:15.179190Z"}, {"uuid": "a3105061-8715-459d-8d65-c254b67ac5b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mnujybl5aw2o", "content": "\ud83d\udce2 CISA KEV ALERT! An actively exploited DoS flaw (CVE-2026-28318) in SolarWinds Serv-U is on the loose. Federal agencies must patch by June 19. All orgs using Serv-U are urged to update immediately! \ud83d\udea8 #CVE #SolarWinds #Infosec #PatchNow\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "creation_timestamp": "2026-06-09T15:43:20.528978Z"}, {"uuid": "550a719d-c5ab-4092-9feb-02a3316767b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3mnukwrns6n2d", "content": "CISA flags actively exploited SolarWinds Serv-U DoS vulnerability (CVE-2026-28318) in KEV catalog\u2014organizations using Serv-U should prioritize patching.\n\nhttps://thehackernews.com/2026/06/cisa-adds-actively-exploited-solarwinds.html\n\n#cybersecurity #infosec", "creation_timestamp": "2026-06-09T16:00:23.473947Z"}, {"uuid": "b09ad7cd-d805-4b07-a08d-e0f7fd950ecd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28164", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ihjjej63cquvp", "content": "CVE-2026-28164 - WordPress Easy Elementor Addons plugin\nCVE ID : CVE-2026-28164\n \n Published : Aug. 20, 2026, 1:17 p.m. | 32\u00a0minutes ago\n \n Description : Cross-Site Request Forgery (CSRF) vulnerability in HashThemes Easy Elementor Addons allows Cross Site Request Forgery.\n\nThi...", "creation_timestamp": "2026-08-20T14:37:04.973176Z"}, {"uuid": "9e818393-4e93-44a0-99a7-f32982cb7cca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2823", "type": "seen", "source": "https://bsky.app/profile/theresidentmachine.bsky.social/post/3mnvwwjxyxz22", "content": "CVE-2026-2823: The NTP Field That Set the Clock and Spawned a Shell\n\n#TheResident #ehabhussein #cybersecurity #infosec #vulnerability #CVE #hacking #security #CVE20262823", "creation_timestamp": "2026-06-10T05:07:40.080094Z"}, {"uuid": "5d936959-d315-400c-be02-24e721e2631b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3mnwalz446726", "content": "\ud83d\udea8 ACTIVE THREAT: CVE-2026-28318 (CVSS 9.1)\n\nPrivilege escalation in Microsoft Entra ID. Tenant-wide impact.\n\nAffects: Microsoft Entra, Azure AD\n\nIf you're running Microsoft Entra, check your patch status today.\n\n\ud83d\udee1\ufe0f Don't wait for the breach. Get your free vulnerability scan \u2192 securitycyber.uk\n\n#Cybe", "creation_timestamp": "2026-06-10T08:00:44.111732Z"}, {"uuid": "d43329fe-32b1-4984-843e-6d4fba924a2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3mnwplnodfc2x", "content": "Correction on our earlier CVE-2026-28318 alert.\n\nThe affected product was listed as \"SolarWinds Serv-U DoS\" \u2014 that's the vulnerability type, not the product name.\n\nCorrect: SolarWinds Serv-U. The flaw is an uncontrolled resource consumption issue causing denial of service. CVSS 7.5, CISA K", "creation_timestamp": "2026-06-10T12:28:58.250024Z"}, {"uuid": "19adf7e7-dc78-4530-9b98-2ad5447f3215", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3mnwqmq6uco2i", "content": "Quick correction on our earlier post: CVE-2026-28318 affects SolarWinds Serv-U, not Microsoft Entra ID as we stated. The NVD listing confirms it is a crafted POST request crash in Serv-U (CVSS 7.5, HIGH).\n\nWe got the product name wrong. That is on us. In this business, precision matters \u2014 if we cann", "creation_timestamp": "2026-06-10T12:47:28.167128Z"}, {"uuid": "4e357787-5bcd-465b-ba23-d7b4a717526f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/cyberowi.pl/post/3mnyy5f6k3z26", "content": "\ud83d\udea8 SolarWinds Serv-U: Luka DoS aktywnie wykorzystywana. Alert CVE-2026-28318\n\nLuka CVE-2026-28318 w SolarWinds Serv-U pozwala na zdalne wywo\u0142anie awarii us\u0142ugi. CISA potwierdza aktywne ataki i\n\nhttps://cyberowi.pl/solarwinds-serv-u-luka-dos-aktywnie-wykorzystywana-alert/\n\n#cyberbezpieczenstwo", "creation_timestamp": "2026-06-11T10:07:22.718165Z"}, {"uuid": "0bcae5b8-c1ba-4622-b4ac-52c3ca0eae55", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28277", "type": "seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mnzmg7zp4z2u", "content": "~Checkpoint~\nCheck Point Research found SQLi and unsafe deserialization flaws in LangGraph checkpointers leading to RCE.\n-\nIOCs: CVE-2025-67644, CVE-2026-28277, CVE-2026-27022\n-\n#CVE202567644 #LangGraph #ThreatIntel", "creation_timestamp": "2026-06-11T16:10:14.551292Z"}, {"uuid": "b8d92521-7490-4327-9bca-34bee0f27c60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28742", "type": "seen", "source": "https://bsky.app/profile/boredchilada.bsky.social/post/3mnzmpx4uza2v", "content": "~Cisa~\nMultiple critical flaws in Naxclow IoT Platform allow device takeover, credential harvesting, and communication interception.\n-\nIOCs: CVE-2026-42947, CVE-2026-50108, CVE-2026-28742\n-\n#CVE202642947 #IoT #ThreatIntel", "creation_timestamp": "2026-06-11T16:15:41.128393Z"}, {"uuid": "b67c8000-7edd-42bc-8fa1-80e07ed6b414", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28742", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-162-02", "content": "", "creation_timestamp": "2026-06-11T05:00:00.000000Z"}, {"uuid": "3a7dc75c-bc89-4a9d-8ad0-8ef4fb71650c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2827", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mo2e7qfedx2w", "content": "CVE-2026-2827 open-user-map-pro (CVSS Score 4.7) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept #open-user-map-pro", "creation_timestamp": "2026-06-11T23:16:06.510461Z"}, {"uuid": "4d145ef2-c6e1-4347-8b89-b118d1687efb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28742", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mo4ow6q4pn22", "content": "CVE-2026-28742 - Naxclow IoT Platform Use of hard-coded cryptographic key\nCVE ID : CVE-2026-28742\n \n Published : June 12, 2026, 7:16 p.m. | 1\u00a0hour, 51\u00a0minutes ago\n \n Description : Naxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt em...", "creation_timestamp": "2026-06-12T21:32:56.513721Z"}, {"uuid": "90de2aaa-7603-444a-9515-7b998cb80ae9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28742", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116741624707706755", "content": "\ud83d\udea8 CRITICAL: CVE-2026-28742 in Naxclow Smart Doorbell X3 \u2014 hard-coded platform-wide key + no replay protection = broad request forgery & device impersonation. No patch yet. Avoid untrusted networks & monitor devices. https://radar.offseq.com/threat/cve-2026-28742-cwe-321-use-of-hard-coded-cryptogra-637b7b61 #OffSeq #IoTSecurity #Vuln", "creation_timestamp": "2026-06-13T07:32:37.275611Z"}, {"uuid": "fdee5eb5-6b72-405a-8424-b813bb5b0a7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28742", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mo5qcpwmyp27", "content": "Naxclow Smart Doorbell X3 hit by CRITICAL vuln: static platform-wide key allows device & user impersonation. No fix yet \u2014 keep devices off untrusted networks and monitor closely. https://radar.offseq.com/threat/cve-2026-28742-cwe-321-use-of-hard-coded-cryptogra-637b7b61 #OffSeq #IoTSecurity", "creation_timestamp": "2026-06-13T07:32:05.270130Z"}, {"uuid": "7956a2ba-7a0c-40c6-a521-09cff3c79c7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28742", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116742760123723228", "content": "A lot of offensive activities were identified targeting Naxclow Smart Doorbell X3 and other products (CVE-2026-28742) https://vuldb.com/vuln/370711/cti", "creation_timestamp": "2026-06-13T12:19:11.844314Z"}, {"uuid": "ce02b45f-369f-45e8-8067-e8c86e4f8ced", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28742", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mo6g3toq3g2a", "content": "\ud83d\udd34 CVE-2026-28742 - Critical (9.8)\n\nNaxclow devices use a uniform request-signing scheme based on a hard-coded, platform-wide salt em...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-28742/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-13T14:01:30.178171Z"}, {"uuid": "2ac301f2-4d48-4a28-8bcb-c29f6e1bd8ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28840", "type": "seen", "source": "https://infosec.exchange/users/dragonjar/statuses/116753779404601476", "content": "En las \u00faltimas 24 horas se han detectado explotaciones cr\u00edticas en PAN-OS GlobalProtect VPN que permiten accesos no autorizados, un malware NarwhalRAT avanzado de APT37 que usa scripts LNK y PowerShell para infiltrarse, y una vulnerabilidad en MacOS que eleva privilegios v\u00eda Python, adem\u00e1s de t\u00e9cnicas para identificar empresas fantasma y evitar fraudes. Descubre estos y m\u00e1s detalles en el siguiente listado de noticias sobre seguridad inform\u00e1tica:\n\ud83d\uddde\ufe0f \u00daLTIMAS NOTICIAS EN SEGURIDAD INFORM\u00c1TICA \ud83d\udd12====| \ud83d\udd25 LO QUE DEBES SABER HOY \ufeff\ufeff15/06/26\ufeff\ufeff  \ud83d\udcc6 |==== \n\ud83d\udd10 ALERTA POR EXPLOTACI\u00d3N ACTIVA DE VULNERABILIDAD EN PAN-OS GLOBALPROTECT VPN\nPalo Alto Networks ha detectado una explotaci\u00f3n activa de la vulnerabilidad CVE-2026-0257 en su sistema PAN-OS GlobalProtect VPN. Esta falla permite evadir la autenticaci\u00f3n est\u00e1ndar y crear sesiones VPN no autorizadas, poniendo en riesgo la red corporativa. Es fundamental actualizar y reforzar las configuraciones de seguridad para evitar accesos indebidos y posibles brechas de datos.\nDescubre c\u00f3mo proteger tu infraestructura ante esta amenaza cr\u00edtica aqu\u00ed \ud83d\udc49 https://djar.co/m4Ku5\n\ud83e\udd88 AN\u00c1LISIS PROFUNDO DEL MALWARE NARWHALRAT DE APT37\nEl grupo APT37 utiliza un sofisticado malware basado en Python llamado NarwhalRAT que se propaga mediante archivos LNK maliciosos que ejecutan scripts de PowerShell y comandos por lotes. Esta campa\u00f1a combina t\u00e9cnicas avanzadas de phishing tem\u00e1tico, comandos C2 en modo sigiloso y persistencia, afectando a m\u00faltiples entornos empresariales. Comprender su modus operandi es clave para implementar defensas efectivas.\nConsulta el informe completo con indicadores de compromiso y estrategias de mitigaci\u00f3n aqu\u00ed \ud83d\udc49 https://djar.co/nEUM\n\ud83d\udc0d NUEVA VULNERABILIDAD EN MACOS PERMITE ESCALAR PRIVILEGIOS USANDO PYTHON\nLa vulnerabilidad CVE-2026-28840 detectada en MacOS permite a atacantes con acceso limitado elevar sus privilegios mediante scripts en Python, comprometiendo la integridad del sistema operativo. Este fallo representa un riesgo cr\u00edtico para usuarios y organizaciones que dependen de entornos Mac, especialmente en sectores sensibles. Actualizar y aplicar parches es urgente para cerrar esta brecha.\nInf\u00f3rmate sobre los detalles t\u00e9cnicos y pasos para proteger tus equipos Mac aqu\u00ed \ud83d\udc49 https://djar.co/LMnK\n\ud83d\udd0d C\u00d3MO IDENTIFICAR UNA EMPRESA FANTASMA EN 2026: 7 SE\u00d1ALES CLAVE\nEn el entorno empresarial actual, distinguir compa\u00f1\u00edas leg\u00edtimas de empresas ficticias es vital para evitar fraudes y malas inversiones. Esta gu\u00eda pr\u00e1ctica expone 7 se\u00f1ales basadas en t\u00e9cnicas OSINT y herramientas gratuitas que te ayudar\u00e1n a verificar la autenticidad de cualquier empresa. Incluye un an\u00e1lisis detallado de un caso real, paso a paso, para que puedas aplicar estos m\u00e9todos de inmediato.\nAprende a detectar riesgos ocultos y proteger tus decisiones comerciales aqu\u00ed \ud83d\udc49 https://djar.co/3pU6", "creation_timestamp": "2026-06-15T11:01:35.537632Z"}, {"uuid": "f162a44c-ba5d-4193-b9b1-5b24313c41e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "exploited", "source": "https://t.me/cyberok_news/225", "content": "\u26d4\ufe0f \u041e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 \u0432 SolarWinds Serv-U\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u044b\u0441\u043e\u043a\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 CVE-2026-28318 \u0432 SolarWinds Serv-U \u2014 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u043c \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u043c \u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0430\u0439\u043b\u043e\u0432 (FTP/SFTP) \u2014 \u0431\u044b\u043b\u0430 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u0432\u0435\u043d\u0434\u043e\u0440\u043e\u043c 03.06.2026, \u0437\u0430\u043f\u0438\u0441\u044c \u0432 NVD \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430 04.06.2026. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0441 \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435 \u0440\u0430\u0431\u043e\u0442\u044b \u0441\u043b\u0443\u0436\u0431\u044b (\u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438).\n\n\ud83d\udcca \u041c\u0430\u0441\u0448\u0442\u0430\u0431\n\u0421\u041a\u0418\u041f\u0410 \u0444\u0438\u043a\u0441\u0438\u0440\u0443\u0435\u0442 \u043e\u043a\u043e\u043b\u043e ~4500 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0445 \u0445\u043e\u0441\u0442\u043e\u0432 \u0441 SolarWinds Serv-U, \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0445 \u0438\u0437\u0432\u043d\u0435 \u0432 \u0420\u0443\u043d\u0435\u0442\u0435. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u043f\u043e\u0447\u0442\u0438 \u0432\u0441\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u044b. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0421\u041a\u0418\u041f\u0410 PentOps \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u044b.\n\n\ud83e\udde0 \u0410\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f\nSolarWinds Serv-U \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0435\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u043e\u0433\u043e \u0440\u0430\u0441\u0445\u043e\u0434\u0430 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432 \u043f\u0440\u0438 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0435 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0441\u043e \u0441\u0436\u0430\u0442\u0438\u0435\u043c. \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u0435\u0440\u0432\u0435\u0440 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0443 \u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043e \u044d\u0442\u0430\u043f\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043b\u044e\u0431\u043e\u043c\u0443 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 POST-\u0437\u0430\u043f\u0440\u043e\u0441 \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c Content-Encoding: deflate, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0439 \u00ab\u0431\u043e\u043c\u0431\u0443\u00bb \u0441\u0436\u0430\u0442\u0438\u044f (decompression bomb). \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u043b\u0438\u043c\u0438\u0442\u044b \u043d\u0430 \u043f\u043e\u0442\u0440\u0435\u0431\u043b\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438/CPU \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442, \u043f\u0440\u043e\u0446\u0435\u0441\u0441 Serv-U \u043c\u043e\u043c\u0435\u043d\u0442\u0430\u043b\u044c\u043d\u043e \u043f\u043e\u0433\u043b\u043e\u0449\u0430\u0435\u0442 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u044b \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0438 \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442\u0441\u044f \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u043e.\n\n\u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u0432\u0435\u0441\u0442\u0438 \u0438\u0437 \u0441\u0442\u0440\u043e\u044f \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0444\u0430\u0439\u043b\u043e\u0432. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435: 5 \u0438\u044e\u043d\u044f 2026 \u0433\u043e\u0434\u0430 \u043e\u043d\u0430 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0430 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 KEV \u0430\u0433\u0435\u043d\u0442\u0441\u0442\u0432\u0430 CISA.\n\n\ud83d\udca5 \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\u2022 \u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u043e\u0435 \u041f\u041e: SolarWinds Serv-U 15.5.4 \u0438 \u043d\u0438\u0436\u0435\n\u2022 \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e: 15.5.4 Hotfix 1\n\u2022 \u0422\u0438\u043f: \u041e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438 (Denial of Service)\n\u2022 \u041a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f: CWE-400 (Uncontrolled Resource Consumption)\n\u2022 \u041a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442: \u041c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0441 Content-Encoding: deflate\n\u2022 \u041f\u0440\u0438\u0447\u0438\u043d\u0430: \u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043b\u0438\u043c\u0438\u0442\u043e\u0432 \u043f\u0440\u0438 \u0440\u0430\u0441\u043f\u0430\u043a\u043e\u0432\u043a\u0435 deflate-\u043f\u043e\u0442\u043e\u043a\u0430 (decompression bomb)\n\u2022 \u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438: \ud83d\udd3b \u0412\u044b\u0441\u043e\u043a\u0438\u0439 (CVSS 3.1: 7.5)\n\u2022 \u0412\u0435\u043a\u0442\u043e\u0440 \u0430\u0442\u0430\u043a\u0438: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\n\n\ud83d\udd0d \u0418\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0430\u0442\u0430\u043a\u0438\n\u2022 \u0410\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u044b\u0435 POST-\u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 Serv-U \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c Content-Encoding: deflate \u2014 \u0438\u043c\u0435\u043d\u043d\u043e deflate \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u044b\u043c \u0432\u0435\u043a\u0442\u043e\u0440\u043e\u043c. \n\u2022 \u0420\u0435\u0437\u043a\u0438\u0435 \u0432\u0441\u043f\u043b\u0435\u0441\u043a\u0438 CPU/RAM \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u043c Serv-U \u043f\u0435\u0440\u0435\u0434 \u0430\u0432\u0430\u0440\u0438\u0439\u043d\u044b\u043c \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u0435\u043c. \n\u2022 \u0412\u043d\u0435\u0437\u0430\u043f\u043d\u044b\u0435 \u043f\u0430\u0434\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 Serv-U \u0438 \u0437\u0430\u043f\u0438\u0441\u0438 \u043e \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u0445. \n\u2022 \u041e\u0431\u0440\u044b\u0432\u044b \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 \u0438 \u0442\u0430\u0439\u043c-\u0430\u0443\u0442\u044b \u0443 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 (\u043f\u043e\u0441\u043b\u0435 crash \u0441\u0435\u0440\u0432\u0438\u0441 \u043d\u0435\u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d). \n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n1. \u041e\u0431\u043d\u043e\u0432\u0438\u0442\u0435 SolarWinds Serv-U \u0434\u043e 15.5.4 Hotfix 1 \u0438\u043b\u0438 \u043d\u043e\u0432\u0435\u0435.\n\n2. \u041f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u0435 \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0435 \u043c\u0435\u0440\u044b, \u0435\u0441\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e.  \n\u0412\u0435\u043d\u0434\u043e\u0440 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u0432 Trust Center: \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0439\u0442\u0435 \u043b\u044e\u0431\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0441 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u043c Content-Encoding \u2014 Serv-U \u043d\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u044d\u0442\u0443 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c. \u041d\u0430\u0441\u0442\u0440\u043e\u0439\u0442\u0435 WAF/IPS \u043d\u0430 \u043f\u043e\u043b\u043d\u044b\u0439 \u0431\u043b\u043e\u043a (\u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e POST \u0438 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e deflate).\n\n3. \u041e\u0433\u0440\u0430\u043d\u0438\u0447\u044c\u0442\u0435 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0434\u043e\u0441\u0442\u0443\u043f. \u041d\u0435 \u0432\u044b\u0441\u0442\u0430\u0432\u043b\u044f\u0439\u0442\u0435 Serv-U \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u2014 VPN, \u0431\u0435\u043b\u044b\u0435 \u0441\u043f\u0438\u0441\u043a\u0438 IP, \u0441\u0442\u0440\u043e\u0433\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 FW.\n\n4. \u041f\u0440\u043e\u0432\u0435\u0440\u044c\u0442\u0435 \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u043f\u0430\u0434\u0435\u043d\u0438\u044f \u0441\u043b\u0443\u0436\u0431\u044b \u043f\u043e\u0441\u043b\u0435 03.06.2026.\n\n5. \u041e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u044c \u0432\u0435\u043d\u0434\u043e\u0440\u0430:\nhttps://www.solarwinds.com/trust-center/security-advisories/CVE-2026-28318", "creation_timestamp": "2026-08-06T00:00:57.740413Z"}, {"uuid": "96876bea-b826-47e6-862d-4769e0bb9ddf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28699", "type": "published-proof-of-concept", "source": "https://github.com/go-gitea/gitea/security/advisories/GHSA-9r5x-wg6m-x2rc", "content": "", "creation_timestamp": "2026-06-05T22:22:25.000000Z"}, {"uuid": "f5156dc3-1af7-4d71-bad0-34fff30ac128", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28744", "type": "published-proof-of-concept", "source": "https://github.com/go-gitea/gitea/security/advisories/GHSA-cc8w-r4qh-3v65", "content": "", "creation_timestamp": "2026-05-25T19:19:11.000000Z"}, {"uuid": "4a456c26-3a64-4b3d-a929-314a0bbab60d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mohy7fkq462t", "content": "CVE-2026-28576 - Contacts Provider SQL Injection\nCVE ID : CVE-2026-28576\n \n Published : June 17, 2026, 7:19 a.m. | 1\u00a0hour, 49\u00a0minutes ago\n \n Description : In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to loc...", "creation_timestamp": "2026-06-17T09:18:26.466258Z"}, {"uuid": "8016f202-48f4-4cb7-84c5-0b1626fa8b45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28615", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mohymvvjkq22", "content": "CVE-2026-28615 - Telecomm Local Privilege Escalation via Permissions Bypass\nCVE ID : CVE-2026-28615\n \n Published : June 17, 2026, 7:17 a.m. | 1\u00a0hour, 51\u00a0minutes ago\n \n Description : In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permission...", "creation_timestamp": "2026-06-17T09:26:00.149138Z"}, {"uuid": "f2a89a01-5439-4af6-8552-57351923f449", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28587", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mohysbwee72z", "content": "CVE-2026-28587 - In MmsSmsProvider of MmsSmsProvider.java, there is\nCVE ID : CVE-2026-28587\n \n Published : June 17, 2026, 7:21 a.m. | 1\u00a0hour, 47\u00a0minutes ago\n \n Description : In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due...", "creation_timestamp": "2026-06-17T09:29:00.281579Z"}, {"uuid": "54a89804-dbd8-4c35-a786-7acc878c1f18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28575", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moi2kk2oaa2f", "content": "CVE-2026-28575 - Android PackageInstaller Denial of Service via Memory Exhaustion\nCVE ID : CVE-2026-28575\n \n Published : June 17, 2026, 7:02 a.m. | 2\u00a0hours, 6\u00a0minutes ago\n \n Description : In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/se...", "creation_timestamp": "2026-06-17T10:01:04.611715Z"}, {"uuid": "2c1f4773-868a-4d91-8ea5-0fbed7011a6e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28737", "type": "published-proof-of-concept", "source": "https://github.com/go-gitea/gitea/security/advisories/GHSA-9cpj-qc93-vw8v", "content": "", "creation_timestamp": "2026-06-14T20:13:42.000000Z"}, {"uuid": "5bc5d4c3-e845-4b9f-a73b-d075ac044be2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28573", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mokenf2b4c2w", "content": "CVE-2026-28573 - Android Persistent Denial of Service\nCVE ID : CVE-2026-28573\n \n Published : June 18, 2026, 6:29 a.m. | 1\u00a0hour, 13\u00a0minutes ago\n \n Description : In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This coul...", "creation_timestamp": "2026-06-18T08:06:22.518716Z"}, {"uuid": "d9658b10-206c-419b-b38d-031f48bee02e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28573", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mokhoa7m7y2x", "content": "CRITICAL: CVE-2026-28573 in Android 14 & 16 lets attackers cause persistent denial of service \u2014 no privileges or user action needed. Patch status unknown. Check advisories: https://radar.offseq.com/threat/cve-2026-28573-denial-of-service-in-google-android-3a071465298b8ea9 #OffSeq #Android #Vulner...", "creation_timestamp": "2026-06-18T09:00:30.955076Z"}, {"uuid": "504982de-c401-4f0b-a146-af5ef15601ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28573", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116770290249457074", "content": "\ud83d\udea9 CVE-2026-28573 (CRITICAL): Google Android 14 & 16 have a flaw in AndroidManifest.xml causing persistent local DoS \u2014 no privileges or user action required. Patch not confirmed. Stay alert: https://radar.offseq.com/threat/cve-2026-28573-denial-of-service-in-google-android-3a071465298b8ea9 #OffSeq #Android #Vuln #MobileSecurity", "creation_timestamp": "2026-06-18T09:00:32.593358Z"}, {"uuid": "58df2029-1c7a-4674-a616-9f67b9e117c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/samilaiho.com/post/3mokq2q4cik2a", "content": "A Crash, Not a Shell: SolarWinds Serv-U CVE-2026-28318\nbishopfox.com/blog/a-crash...", "creation_timestamp": "2026-06-18T11:30:48.805969Z"}, {"uuid": "4d408330-7190-4b47-bd9d-0974b3eb7465", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28573", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116775036898916002", "content": "It is possible to see elevated activities targeting Google Android (CVE-2026-28573) https://vuldb.com/vuln/372187/cti", "creation_timestamp": "2026-06-19T05:07:41.500163Z"}, {"uuid": "2e4b8177-93e1-4509-90b0-23c82adf596b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "published-proof-of-concept", "source": "Telegram/UP0bHdwN2udFarZFpAo4dW_5awpjME5BMssCjsrIyWufG1U", "content": "", "creation_timestamp": "2026-06-10T15:00:07.000000Z"}, {"uuid": "5fc6b964-8154-4b0e-8d45-23dd01915e16", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "published-proof-of-concept", "source": "Telegram/cFwSQ27uOrqZ96YGVM-ku7YiP0UftFdUhE6IZpDdkcLlq7k", "content": "", "creation_timestamp": "2026-06-13T03:00:05.000000Z"}, {"uuid": "8fc7bf35-378e-47f1-ae2c-eb3b5475d46a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28699", "type": "published-proof-of-concept", "source": "Telegram/X3d0ov_B01fXeFh1HIc4iOWU-yKPAhiRlXClKZPas190B7A", "content": "", "creation_timestamp": "2026-06-11T09:00:04.000000Z"}, {"uuid": "6fc887fd-097d-43d1-ba89-586237e128a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28699", "type": "published-proof-of-concept", "source": "Telegram/bfOUhtYO5_knJKoj_if_OKxt7hZq78r0zHfwCUUuIAza2Gk", "content": "", "creation_timestamp": "2026-06-11T11:00:12.000000Z"}, {"uuid": "81de02f1-b65b-4665-8430-2111de1d80cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "exploited", "source": "Telegram/RjFtPT0Qt3W0A0xNEsz-oWGIM9AmnTe6qgjGlCecqaERag", "content": "", "creation_timestamp": "2026-06-06T16:17:46.000000Z"}, {"uuid": "7c7c0047-0440-4a6f-b813-824b1b8000e5", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/201a6287-73ac-44f1-ad01-3e8f8deb3798", "content": "", "creation_timestamp": "2026-06-19T12:45:09.782720Z"}, {"uuid": "c2a4ca98-f2ed-4c58-aafa-f47c5b56e7af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28409", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-29)", "content": "", "creation_timestamp": "2026-08-30T10:15:11.130568Z"}, {"uuid": "ff6ac2a7-1b47-405e-96f3-1d5a2c02635a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28496", "type": "exploited", "source": "The Shadowserver (honeypot/exploited-vulnerabilities) - (2026-08-29)", "content": "", "creation_timestamp": "2026-08-30T10:15:11.238963Z"}, {"uuid": "b1e5bf6e-9716-49d6-a86a-ed62d8f98075", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28575", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260622", "content": "", "creation_timestamp": "2026-06-21T18:00:00.000000Z"}, {"uuid": "2439ecb3-5729-4899-86f3-511ed47b4e20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260622", "content": "", "creation_timestamp": "2026-06-21T18:00:00.000000Z"}, {"uuid": "3116dad4-f8b6-4575-b80b-167e4e6435c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28615", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260622", "content": "", "creation_timestamp": "2026-06-21T18:00:00.000000Z"}, {"uuid": "6a02711e-3ad8-4c89-9e0c-e9717ac39e81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28615", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1931", "content": "", "creation_timestamp": "2026-06-21T21:00:00.000000Z"}, {"uuid": "a5b47dc6-5dec-44f5-8603-9020181989b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28587", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260622", "content": "", "creation_timestamp": "2026-06-21T18:00:00.000000Z"}, {"uuid": "9fa5f040-63b4-4a3f-a95b-539aaae3bcf5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28672", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5if5ljlxwuhwj", "content": "CVE-2026-28672 - Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder\nCVE ID : CVE-2026-28672\n \n Published : Aug. 10, 2026, 10:26 a.m. | 3\u00a0minutes ago\n \n Description : Improper Neutralization of Special Elements used in a Command ('Command Injection') vulne...", "creation_timestamp": "2026-08-10T10:59:32.611834Z"}, {"uuid": "ab870560-08ab-4491-93b9-3308f5a119ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1931", "content": "", "creation_timestamp": "2026-06-21T21:00:00.000000Z"}, {"uuid": "ccdff0f0-eb5f-4543-9e02-7bfba9bb68f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28587", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1931", "content": "", "creation_timestamp": "2026-06-21T21:00:00.000000Z"}, {"uuid": "06d7ff50-cafd-452e-98f7-1ad77a536706", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28575", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1931", "content": "", "creation_timestamp": "2026-06-21T21:00:00.000000Z"}, {"uuid": "07e5ddb0-ee49-41a0-a3f1-ed7903e76845", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28381", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3movdgbwzk622", "content": "CVE-2026-28381 - Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT\nCVE ID : CVE-2026-28381\n \n Published : June 22, 2026, 1:20 p.m. | 2\u00a0hours, 23\u00a0minutes ago\n \n Description : The Snowflake datasource allows for GET/PUT commands, which can allow any u...", "creation_timestamp": "2026-06-22T16:43:45.264928Z"}, {"uuid": "af3ae275-23a9-409d-8207-9d05090ef332", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28381", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3movepagixn2c", "content": "CVE-2026-28381 - Critical supply chain attack in Grafana. Snowflake datasource GET/PUT commands allow file read/write between server and host. CVSS 9.6. No patch yet - restrict access immediately. #CVE #Grafana #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-28381/", "creation_timestamp": "2026-06-22T17:06:39.507775Z"}, {"uuid": "9d33ef68-091a-49bf-b415-979d240b302c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28381", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/116796107817956052", "content": "Attention, elevated activities detected targeting Grafana Snowflake Datasource (CVE-2026-28381) https://vuldb.com/vuln/372678/cti", "creation_timestamp": "2026-06-22T22:26:13.079439Z"}, {"uuid": "623b89db-1acd-42cc-bc54-40ead7dfb9b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://t.me/lobushkinflash/18578", "content": "Apple \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0432\u043d\u0435\u043f\u043b\u0430\u043d\u043e\u0432\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f iOS \u0438 iPadOS, \u0437\u0430\u043a\u0440\u044b\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-28950, \u0438\u0437-\u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f, \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435, \u043c\u043e\u0433\u043b\u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0421\u041c\u0418, \u0438\u043c\u0435\u043d\u043d\u043e \u0447\u0435\u0440\u0435\u0437 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u0424\u0411\u0420 \u0441\u043c\u043e\u0433\u043b\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f Signal \u0441 iPhone \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u0435\u043c\u043e\u0433\u043e, \u0434\u0430\u0436\u0435 \u043f\u043e\u0441\u043b\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. Signal \u043f\u043e\u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u0438\u043b Apple \u0437\u0430 \u0431\u044b\u0441\u0442\u0440\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u2014 Bleeping Computer\n\n#Signal #Apple #cybersecurity", "creation_timestamp": "2026-08-06T07:00:04.212746Z"}, {"uuid": "fd218950-c0da-46ce-8ba5-0d002d0b0323", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/0ab957d4-f6b3-43d3-a77c-8866fbe67fcb", "content": "", "creation_timestamp": "2026-06-23T14:03:01.617503Z"}, {"uuid": "f0743965-999b-4fc3-a33a-2871e2e658ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28496", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3moxs32hcvd2w", "content": "CVE-2026-28496 - FOSSBilling: Server-side template injection in Twig template rendering enables information disclosure and RCE\nCVE ID : CVE-2026-28496\n \n Published : June 23, 2026, 2:20 p.m. | 1\u00a0hour, 23\u00a0minutes ago\n \n Description : FOSSBilling is a free, open-source billing a...", "creation_timestamp": "2026-06-23T16:11:13.997223Z"}, {"uuid": "2860f536-e4bd-4758-b2fb-6ea34e754233", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28496", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/116800802356327413", "content": "New.\n\"Today VulnCheck is disclosing CVE-2026-28496, an unauthenticated remote code execution chain in FOSSBilling, the open-source billing and client-management platform.\"\nVulnCheck: CVE-2026-28496 - FOSSBilling Auth Bypass and Twig SSTI to Unauthenticated RCE https://www.vulncheck.com/blog/fossbilling-auth-bypass-ssti-rce @vulncheck #infosec #opensource #vulnerability", "creation_timestamp": "2026-06-23T18:20:14.295475Z"}, {"uuid": "8d7cdd41-f28f-498c-b8fa-c6da4e6f363b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28496", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-28496.yaml", "content": "", "creation_timestamp": "2026-06-23T07:40:44.000000Z"}, {"uuid": "ee697ee9-7668-4006-be82-0c4fff7e9a3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28496", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-28496.yaml", "content": "", "creation_timestamp": "2026-06-24T15:00:03.618202Z"}, {"uuid": "71d4750b-c922-4534-a814-bacf83a3167f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28496", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-28496.yaml", "content": "", "creation_timestamp": "2026-06-25T00:00:02.672972Z"}, {"uuid": "1a546bd8-5779-46fe-aa8e-b1dddbc07638", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2815", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp4s6q6fxv2s", "content": "CVE-2026-2815 - Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys\nCVE ID : CVE-2026-2815\n \n Published : June 25, 2026, 1:27 p.m. | 1\u00a0hour, 43\u00a0minutes ago\n \n Description : Incorrect use of the PUF key for user key generation in EFR32x...", "creation_timestamp": "2026-06-25T15:56:36.538903Z"}, {"uuid": "6e3caaec-a549-4bd2-85c1-b104dda0d345", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28701", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-04", "content": "", "creation_timestamp": "2026-06-25T17:15:07.412574Z"}, {"uuid": "3b9142c6-e9ea-4a87-9064-965536865008", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28496", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-28496.yaml", "content": "", "creation_timestamp": "2026-06-26T00:00:02.826649Z"}, {"uuid": "ab84e232-a77e-468e-9792-72aa227c35d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28780", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mp7g7ofsp22y", "content": "\ud83d\udee1\ufe0f SUSE-SU-2026:2641-1: 10 CVEs corrigidas no Apache2, incluindo RCE via HTTP/2 (CVE-2026-23918) e estouro de heap no mod_proxy_ajp (CVE-2026-28780). Saiba mais: -> tinyurl.com/ae6r983h  #SUSE", "creation_timestamp": "2026-06-26T17:00:25.587707Z"}, {"uuid": "1f9be6fe-0e87-40a8-be3d-0203a6676f92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28780", "type": "seen", "source": "https://bsky.app/profile/ferramentaslinux.bsky.social/post/3mp7g7p6hr22y", "content": "\ud83d\udee1\ufe0f SUSE-SU-2026:2641-1: 10 CVEs corrigidas no Apache2, incluindo RCE via HTTP/2 (CVE-2026-23918) e estouro de heap no mod_proxy_ajp (CVE-2026-28780). Saiba mais: -> tinyurl.com/ae6r983h  #SUSE", "creation_timestamp": "2026-06-26T17:00:26.045868Z"}, {"uuid": "2c292c17-f8de-4b74-b290-b36bef4ea7c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28385", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mp7mfbgzqc2h", "content": "CVE-2026-28385 - SSRF via image import from URL allows internal network probing by authenticated users\nCVE ID : CVE-2026-28385\n \n Published : June 26, 2026, 4:23 p.m. | 1\u00a0hour, 21\u00a0minutes ago\n \n Description : In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Fo...", "creation_timestamp": "2026-06-26T18:50:52.312391Z"}, {"uuid": "ea528819-af72-458d-974c-03a5b7da443a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28701", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mpa5fuicyu2l", "content": "CVE-2026-28701 - Daktronics Controller Firmware Path Traversa\nCVE ID : CVE-2026-28701\n \n Published : June 26, 2026, 10:40 p.m. | 31\u00a0minutes ago\n \n Description : Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to esc...", "creation_timestamp": "2026-06-26T23:55:25.951515Z"}, {"uuid": "5e039b80-5ac5-47f4-ae0e-f645220f8fe7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28496", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-28496.yaml", "content": "", "creation_timestamp": "2026-06-27T00:00:03.424317Z"}, {"uuid": "3bd4bccc-b00e-423f-9613-adfdbbd469c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28701", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mpa5pckhft2d", "content": "CRITICAL vuln (CVE-2026-28701) in Daktronics VFC-DMP-5000: remote attackers can enumerate file paths via directory traversal \u2014 no auth needed. Restrict access & monitor until patched. https://radar.offseq.com/threat/cve-2026-28701-cwe-22-in-daktronics-vfc-dmp-5000-fcca115843b7a100 #OffSeq #CVE #I...", "creation_timestamp": "2026-06-27T00:00:43.111919Z"}, {"uuid": "0cc40de9-88b9-41fd-bbf1-0fcb9099d1b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28701", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116819128489204925", "content": "Daktronics VFC-DMP-5000 firmware has a CRITICAL vuln (CVE-2026-28701, CVSS 9.8): remote attackers can traverse directories & enumerate file paths \u2014 no auth needed. No patch yet. Restrict network access & monitor closely. https://radar.offseq.com/threat/cve-2026-28701-cwe-22-in-daktronics-vfc-dmp-5000-fcca115843b7a100 #OffSeq #CVE #Infosec #IoT", "creation_timestamp": "2026-06-27T00:00:44.494482Z"}, {"uuid": "b24cb109-d5de-4952-b540-b58decd47497", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28701", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mpbpyscipb26", "content": "\ud83d\udd34 CVE-2026-28701 - Critical (9.8)\n\nVarious versions of Daktronics Controller Firmware could allow authenticated and unauthenticated ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-28701/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-06-27T15:00:49.265033Z"}, {"uuid": "c40e28e0-8267-45ce-9bf3-13b0329bc677", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28367", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpggvsi32x2n", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-28367 \u0432 Undertow: \u0443\u0433\u0440\u043e\u0437\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/8C62D143-48E5-437F-9942-3441888CD9A2", "creation_timestamp": "2026-06-29T12:01:22.748597Z"}, {"uuid": "0a4701f6-81fd-4288-95c2-68a8f13ba49f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28368", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgh4otquh22", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-28368 \u0432 Undertow: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/5F3D5568-E2A8-491B-AEBD-0B9B6015FBC3", "creation_timestamp": "2026-06-29T12:05:13.886584Z"}, {"uuid": "5ebddc3f-31f7-4011-acb5-dac124a31fe2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28979", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpho2tuau22d", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-28979: \u0443\u0433\u0440\u043e\u0437\u0430 \u0438\u0437-\u0437\u0430 \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044f \u0433\u0440\u0430\u043d\u0438\u0446 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/4F325BA5-C797-4849-8FB8-1CE78C18A747", "creation_timestamp": "2026-06-29T23:42:07.912982Z"}, {"uuid": "febac94d-3776-4ec6-9e6d-41f3635cc46a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28857", "type": "seen", "source": "https://bsky.app/profile/ctsd-gmbh.bsky.social/post/3mpilwer6jx2y", "content": "CVE-2026-20643 und CVE-2026-28857 in KI entdeckt WebKit-L\u00fccken: Apple patcht 30+ Flaws\nKI-Modelle haben zwei neue, hochkritische Sicherheitsl\u00fccken (CVE-2026-20643, CVE-2026-28857) in WebKit entdeckt,\u2026\n\nhttps://www.ctsd.de/insights/2026-06-security-ki-entdeckt-webkit-l-cken-apple-patcht-30-flaws.html", "creation_timestamp": "2026-06-30T08:36:30.535785Z"}, {"uuid": "caa52caa-de94-49ca-b744-26e9bdcab017", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28185", "type": "seen", "source": "https://t.me/captainsmok3r_official/430", "content": "CVE-2026-28185 - \"Log in with Google\" (WordPress) treats an unverified Google email as proof of ownership\nAffected: rtCamp \"Log in with Google\" plugin (slug login-with-google) <= 1.4.2, fixed in 1.4.3\nType: Auth bypass (unauthenticated account takeover, including administrator)", "creation_timestamp": "2026-08-19T00:00:27.299325Z"}, {"uuid": "402d58ca-b45e-489a-9fa2-8644e75ba16f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28185", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/432", "content": "python poc-cve-2026-28185.py --host https://test.com/ --code 4/F0ATsMZqBVDRrYEE********** --username admin@test.com", "creation_timestamp": "2026-08-19T00:00:27.333448Z"}, {"uuid": "19ed4a6b-d5d4-4bbd-9b39-cef28663bc4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28185", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/431", "content": "", "creation_timestamp": "2026-08-19T00:00:27.366311Z"}, {"uuid": "5436a845-ebde-41ea-84f9-0ad95c2042c2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28185", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/433", "content": "--code: An authorization code already issued by Google (or a fake provider) for an unverified identity.\nTo obtain this --code, simply go to the wp-login.php page and click \"login with Google.\" Then, select the Gmail account you want to use to authorize the admin user access. after that, you will be redirected back to the website, and you will see something like this in the URL:\n\nsite.com/wp-login.php?code=...&state=...\n -> ?code= ...\n--code ...\n?code=...\npython poc-cve-2026-28185.py --host https://site.com/ --code ... --username admin@site.com\n\n \u203c\ufe0f this poc doesn\u2019t require authentication, but you do need to have the admin\u2019s email address of the website(for wp-login.php), and that email address must already exist as an admin account. That makes the process a bit difficult.", "creation_timestamp": "2026-08-19T00:00:27.262630Z"}, {"uuid": "0529f23f-3a00-462f-bfae-2a6d34f34294", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28386", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2026-ACT-028", "content": "", "creation_timestamp": "2026-07-01T02:45:02.855675Z"}, {"uuid": "0f8cb9fd-a111-482e-b72d-ba46aa530ef3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28979", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0818", "content": "", "creation_timestamp": "2026-07-01T02:51:04.463089Z"}, {"uuid": "0c6beb33-4364-4a2d-a97c-5baedcd8d3a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28979", "type": "seen", "source": "https://www.thezdi.com/blog/2026/6/30/the-june-2026-apple-security-update-review", "content": "We\u2019re back with our look at the Apple macOS and iOS security updates. As this is a new feature for us, please let us know your feedback on the blog. \nFor Jun 2026, Apple released 37 unique CVEs across iOS 26.5.2 / iPadOS 26.5.2, macOS Tahoe 26.5.2, Safari 26.5.2. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. The overwhelming majority (31 of 37) are WebKit/WebRTC bugs reachable through malicious web content. Most of those are crash/DoS bugs rather than code execution, so the real risk lives in the small set of kernel bugs and the handful of WebKit sandbox escapes. However, there are a couple that stand out.\n-    CVE-2026-43724 (Kernel) \u2013 According to Apple, \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d A kernel memory write is the highest-value primitive here: it's the privilege-escalation half of a full exploit chain and leads to complete device control. The bug was credited to Hyunwoo Kim (@v4bel), who is known to be a serious kernel researcher. \n-    CVE-2026-39868 (Kernel) \u2013 Another kernel bug, this one could \u201ccause unexpected system termination or corrupt kernel memory.\u201d This is kernel memory corruption, and notably credited to a roster of elite offensive researchers (STAR Labs, Positive Technologies, Baidu Security). This kind of attribution usually signals a weaponizable, possibly Pwn2Own-grade bug rather than a theoretical crash.\n-    CVE-2026-43725 / CVE-2026-43701 (WebKit) \u2013 Apple states these bugs could allow a website to process restricted web content outside the sandbox. I'm flagging this sandbox-escape pair over the many WebKit crash bugs because a sandbox escape is the bridge that turns a web-content bug into a path toward the kernel issues above. It's the most dangerous remotely-triggered class in the release.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Update – June 29, 2026\n\n\n\n  \n    \n      37Total CVEs\n      22Denial of Service\n      7Information Disclosure\n      3Memory Corruption\n      2Elevation of Privilege\n      2Sandbox Escape\n      1Spoofing\n    \n\n    \n\n      Apple security release — June 29, 2026. \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS 26.5.2 / iPadOS 26.5.2\n          macOS Tahoe 26.5.2\n          Safari 26.5.2\n        \n      \n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43716\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43746\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-01T16:01:00.839344Z"}, {"uuid": "cc628c72-1ffb-4af1-b633-46693dff6bf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mpmcohfkx22g", "content": "CISA Adds One Known Exploited Vulnerability to Catalog\nRelease Date June 05, 2026\n\nCVE-2026-28318 SolarWinds Serv-U Uncontrolled Resource Consumption Vulnerability", "creation_timestamp": "2026-07-01T20:01:40.528637Z"}, {"uuid": "d7bd54ad-c671-41d3-9fdf-dfa7de9b7791", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28005", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msgfmuhmkn2f", "content": "CVE-2026-28005 - kadence woocommerce email designer\nAn outdated version of the Kadence WooCommerce Email Designer plugin on your WordPress site can allow unauthorized users to access sensitive data. This is a\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#nexcess #CVE #infosec", "creation_timestamp": "2026-08-06T15:54:04.175343Z"}, {"uuid": "c82b4d2d-24ff-45b2-8b5c-215b610a40b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28139", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msgfmvphqq2m", "content": "CVE-2026-28139 - ajax search lite\nThe WordPress Ajax Search Lite plugin is affected by a security risk that could allow an attacker to inject malicious code. This plugin is used for search functionality on WordPress\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#wpdreams #CVE #infosec", "creation_timestamp": "2026-08-06T15:54:05.069473Z"}, {"uuid": "8ce94092-62f4-4ce1-9688-23bf34d3392a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2891", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mpmrpgfmrh2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-2891: \u0443\u0433\u0440\u043e\u0437\u0430 \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 Poly Voice IP \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/029E8B80-6EA4-436D-B0F8-1199E34909FC", "creation_timestamp": "2026-07-02T00:30:38.143653Z"}, {"uuid": "c6608e5a-a588-4f87-b6cf-907f30c37400", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28979", "type": "seen", "source": "https://www.thezdi.com/blog/2026/6/30/the-june-2026-apple-security-update-review", "content": "We\u2019re back with our look at the Apple macOS and iOS security updates. As this is a new feature for us, please let us know your feedback on the blog. \nFor Jun 2026, Apple released 37 unique CVEs across iOS 26.5.2 / iPadOS 26.5.2, macOS Tahoe 26.5.2, Safari 26.5.2. Since Apple doesn\u2019t provide CVSS scores or other severity information, we\u2019re left to speculate on which of these bugs is the most severe. The overwhelming majority (31 of 37) are WebKit/WebRTC bugs reachable through malicious web content. Most of those are crash/DoS bugs rather than code execution, so the real risk lives in the small set of kernel bugs and the handful of WebKit sandbox escapes. However, there are a couple that stand out.\n-    CVE-2026-43724 (Kernel) \u2013 According to Apple, \u201cAn app may be able to cause unexpected system termination or write kernel memory.\u201d A kernel memory write is the highest-value primitive here: it's the privilege-escalation half of a full exploit chain and leads to complete device control. The bug was credited to Hyunwoo Kim (@v4bel), who is known to be a serious kernel researcher. \n-    CVE-2026-39868 (Kernel) \u2013 Another kernel bug, this one could \u201ccause unexpected system termination or corrupt kernel memory.\u201d This is kernel memory corruption, and notably credited to a roster of elite offensive researchers (STAR Labs, Positive Technologies, Baidu Security). This kind of attribution usually signals a weaponizable, possibly Pwn2Own-grade bug rather than a theoretical crash.\n-    CVE-2026-43725 / CVE-2026-43701 (WebKit) \u2013 Apple states these bugs could allow a website to process restricted web content outside the sandbox. I'm flagging this sandbox-escape pair over the many WebKit crash bugs because a sandbox escape is the bridge that turns a web-content bug into a path toward the kernel issues above. It's the most dangerous remotely-triggered class in the release.\nHere\u2019s a look at all the bugs released by Apple this month:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\n\n\n\nApple Security Update – June 29, 2026\n\n\n\n  \n    \n      37Total CVEs\n      22Denial of Service\n      7Information Disclosure\n      3Memory Corruption\n      2Elevation of Privilege\n      2Sandbox Escape\n      1Spoofing\n    \n\n    \n\n      Apple security release — June 29, 2026. \"Yes/No\" indicates whether each update is affected. CVE IDs link to NVD.\n      \n        \n          CVE ID\n          Component\n          Impact\n          iOS 26.5.2 / iPadOS 26.5.2\n          macOS Tahoe 26.5.2\n          Safari 26.5.2\n        \n      \n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-39868\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43722\n        Kernel\n        An app may be able to leak sensitive kernel state\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43724\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43703\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43706\n        libxslt\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        No\n      \n      \n        CVE-2026-43704\n        Web Extensions\n        A malicious web extension may be able to cause an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-39872\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43663\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43676\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43699\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43700\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43701\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43705\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43707\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43708\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43709\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43712\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43713\n        WebKit\n        Visiting a website may leak sensitive data\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43716\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43725\n        WebKit\n        A malicious website may be able to process restricted web content outside the sandbox\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43726\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43727\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43731\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43732\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43734\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43735\n        WebKit\n        A malicious website may exfiltrate data cross-origin\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43740\n        WebKit\n        Processing maliciously crafted web content may result in the disclosure of process memory\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43742\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43745\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43720\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43721\n        WebKit Storage\n        A malicious website may be able to silently hijack clipboard data\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-28979\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43717\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43718\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n        CVE-2026-43746\n        WebRTC\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        Yes\n        Yes\n        Yes\n      \n      \n    \n  \n\n\n\n  \n  \n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-07-02T01:00:44.745913Z"}, {"uuid": "cb79de1d-bd88-4f92-8ea2-127e0f7f9c69", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28792", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/30458", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, selected to avoid duplicates and previously shared entries.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-33321\n\ud83c\udfaf vBulletin \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/whitehatsk/CVE-2026-33321\n\n\ud83e\udde0 Overview\nA vulnerability in vBulletin allows attackers to execute arbitrary code via crafted requests targeting improperly validated input parameters.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Web forum compromise\n\u2022 Full server takeover\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-32014\n\ud83c\udfaf Liferay Portal \u2013 Authentication Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/ColdFusionX/CVE-2026-32014\n\n\ud83e\udde0 Overview\nA flaw in Liferay Portal allows attackers to bypass authentication and gain unauthorized access to restricted resources.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Privileged access\n\u2022 Enterprise portal compromise\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-30977\n\ud83c\udfaf PrestaShop \u2013 SQL Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/0xInfection/CVE-2026-30977\n\n\ud83e\udde0 Overview\nA SQL injection vulnerability in PrestaShop enables attackers to manipulate database queries through crafted input.\n\n\u2699\ufe0f Impact\n\u2022 Database compromise\n\u2022 Sensitive data exposure\n\u2022 Privilege escalation\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-29866\n\ud83c\udfaf Flask-Based Application \u2013 Template Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/d3vilbug/CVE-2026-29866\n\n\ud83e\udde0 Overview\nA server-side template injection vulnerability allows attackers to execute arbitrary code via unsanitized user input.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Application compromise\n\u2022 Data exposure\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-28792\n\ud83c\udfaf Magento \u2013 Arbitrary File Upload\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/blackhatsociety/CVE-2026-28792\n\n\ud83e\udde0 Overview\nA vulnerability in Magento allows attackers to upload malicious files, leading to remote code execution on the server.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Full system compromise\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Vulnerability research\n\u2022 Exploit development\n\u2022 Patch analysis\n\u2022 Red team / blue team exercises\n\n\u26a0\ufe0f Ethical Notice\nThis content is shared for cybersecurity research and defensive purposes only.\nDo not use this information for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T11:00:03.171110Z"}, {"uuid": "cb80749f-65b8-42c6-bbac-5c824203bb92", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28711", "type": "seen", "source": "https://t.me/CyberSecurityExploit/30370", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, selected to avoid duplicates and outdated entries.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-31452\n\ud83c\udfaf OpenCart \u2013 Arbitrary File Upload \u2192 RCE\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/exploitblizzard/CVE-2026-31452\n\n\ud83e\udde0 Overview\nA vulnerability in OpenCart allows attackers to upload arbitrary files without proper validation, leading to remote code execution on the server.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Full web server compromise\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-30121\n\ud83c\udfaf Zimbra Collaboration \u2013 Authentication Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/ry4n-h/CVE-2026-30121\n\n\ud83e\udde0 Overview\nA flaw in Zimbra allows attackers to bypass authentication mechanisms and gain unauthorized access to user accounts.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Account takeover\n\u2022 Email system compromise\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-28711\n\ud83c\udfaf Jenkins \u2013 Script Console Abuse\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/wh0amitz/CVE-2026-28711\n\n\ud83e\udde0 Overview\nA vulnerability in Jenkins enables attackers to execute arbitrary scripts through misconfigured or exposed script console endpoints.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 CI/CD pipeline compromise\n\u2022 Credential exposure\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-27654\n\ud83c\udfaf Drupal Module \u2013 SQL Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/0xM4hmoud/CVE-2026-27654\n\n\ud83e\udde0 Overview\nA SQL injection vulnerability in a Drupal module allows attackers to manipulate database queries and extract sensitive data.\n\n\u2699\ufe0f Impact\n\u2022 Database compromise\n\u2022 Data leakage\n\u2022 Privilege escalation\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-26590\n\ud83c\udfaf Node.js Application \u2013 Prototype Pollution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/s4vitar/CVE-2026-26590\n\n\ud83e\udde0 Overview\nA prototype pollution vulnerability allows attackers to modify application logic by injecting malicious object properties.\n\n\u2699\ufe0f Impact\n\u2022 Application logic manipulation\n\u2022 Potential RCE chain\n\u2022 Security control bypass\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Exploit development\n\u2022 Patch analysis\n\u2022 Vulnerability chain study\n\u2022 Red / Blue Team training\n\n\u26a0\ufe0f Ethical Notice\nThis information is provided for cybersecurity research and defensive purposes only.\nDo not use it for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-15T11:00:04.833882Z"}, {"uuid": "ce3a306f-d056-4b39-b2ae-fb725c782936", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28323", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3msrmyjzble2u", "content": "The latest update for #ArcticWolf includes \"Active #SupplyChain Attack on npm Packages (keyv, cacheable): Immediate Mitigation Required\" and \"SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299\".\n \n#cybersecurity #infosec #networks https://opsmtrs.com/2ZFbaTl", "creation_timestamp": "2026-08-11T03:05:09.105869Z"}, {"uuid": "b8582e7b-6f8d-4323-9fec-b533663347b7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28299", "type": "seen", "source": "https://bsky.app/profile/opsmatters.com/post/3msrmyjzble2u", "content": "The latest update for #ArcticWolf includes \"Active #SupplyChain Attack on npm Packages (keyv, cacheable): Immediate Mitigation Required\" and \"SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299\".\n \n#cybersecurity #infosec #networks https://opsmtrs.com/2ZFbaTl", "creation_timestamp": "2026-08-11T03:05:09.175647Z"}, {"uuid": "eed82c68-333a-4d45-abbe-f08fa8e52d5a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28322", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mporrnzimn22", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-28322 \u0432 SolarWinds Database Performance Analyzer: \u0443\u0433\u0440\u043e\u0437\u0430 \u0438 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0437\u0430\u0449\u0438\u0442\u044b\n\n\n\nhttps://kripta.biz/posts/424EB2AC-F613-4113-B741-44CC6FD62914", "creation_timestamp": "2026-07-02T19:37:12.802353Z"}, {"uuid": "914a627e-a8c5-47f2-b69a-2714e0fa8801", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28185", "type": "seen", "source": "https://t.me/captainsmok3r_official/430", "content": "CVE-2026-28185 - \"Log in with Google\" (WordPress) treats an unverified Google email as proof of ownership\nAffected: rtCamp \"Log in with Google\" plugin (slug login-with-google) <= 1.4.2, fixed in 1.4.3\nType: Auth bypass (unauthenticated account takeover, including administrator)", "creation_timestamp": "2026-08-18T02:00:04.229727Z"}, {"uuid": "e59dd42f-7a90-4647-93c0-73ef99bcf6aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28185", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/432", "content": "python poc-cve-2026-28185.py --host https://test.com/ --code 4/F0ATsMZqBVDRrYEE********** --username admin@test.com", "creation_timestamp": "2026-08-18T02:00:04.281258Z"}, {"uuid": "9a480023-ad6f-4cb4-846f-cda320d27624", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28185", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/431", "content": "", "creation_timestamp": "2026-08-18T02:00:04.324207Z"}, {"uuid": "89f68c81-4e26-4262-be7c-27453a0600c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mprm7hhxj22h", "content": "CISA\u304c\u3001\u60aa\u7528\u3055\u308c\u3066\u3044\u308bSolarWinds Serv-U\u306eDoS\u8106\u5f31\u6027\u3092KEV\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\n\n\u7c73\u56fd\u306e\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001SolarWinds Serv-U\u30de\u30eb\u30c1\u30d7\u30ed\u30c8\u30b3\u30eb\u30d5\u30a1\u30a4\u30eb\u30b5\u30fc\u30d0\u30fc\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u306b\u5f71\u97ff\u3092\u4e0e\u3048\u308b\u91cd\u5927\u5ea6\u306e\u9ad8\u3044\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u6b20\u9665\u3092\u3001\u65e2\u77e5\u306e\u60aa\u7528\u4e8b\u4f8b\uff08KEV \uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u305f\u3002\u3053\u308c\u306f\u3001\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u8a3c\u62e0\u304c\u3042\u308b\u305f\u3081\u3060\u3002\n\nCVE-2026-28318\uff08CVSS\u30b9\u30b3\u30a2\uff1a7.5\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308b\u3053\u306e\u8106\u5f31\u6027\u306f\u3001\u7279\u5b9a\u306e\u6761\u4ef6\u4e0b\u3067\u30b5\u30fc\u30d3\u30b9\u3092\u30af\u30e9\u30c3\u30b7\u30e5\u3055\u305b\u308b\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\uff08DoS\uff09\u30d0\u30b0\u3067\u3059\u3002CISA\u306f\u3053\u308c\u3092\u3001\u5236\u5fa1\u4e0d\u80fd\u306a\u30ea\u30bd...", "creation_timestamp": "2026-07-03T22:35:34.721578Z"}, {"uuid": "4e53ab9d-b8c2-4f75-8107-0e36a40bfe13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mprn3m246c2h", "content": "\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09\u306f\u3001SolarWinds Serv-U\u306e\u8106\u5f31\u6027\u3092\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30ea\u30b9\u30c8\u306b\u8ffd\u52a0\u3057\u305f\u3002\n\n\u7c73\u56fd\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fb\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CISA\uff09 \u306f\u3001SolarWinds Serv-U\u306e\u8106\u5f31\u6027\uff08CVE-2026-28318\u3001CVSS\u30d0\u30fc\u30b8\u30e7\u30f33.1\u30b9\u30b3\u30a27.5\uff09\u3092\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\uff08KEV\uff09\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0\u3057\u307e\u3057\u305f\u3002SolarWinds Serv-U\u306f\u3001 SolarWinds\u304c\u958b\u767a\u3057\u305f\u30de\u30cd\u30fc\u30b8\u30c9\u30d5\u30a1\u30a4\u30eb\u8ee2\u9001\uff08MFT\uff09\u304a\u3088\u3073\u30bb\u30ad\u30e5\u30a2\u30d5\u30a1\u30a4\u30eb\u30b5\u30fc\u30d0\u30fc\u30d7\u30e9\u30c3\u30c8\u30d5\u30a9\u30fc\u30e0\u3067\u3059\u3002", "creation_timestamp": "2026-07-03T22:51:19.622227Z"}, {"uuid": "aa387962-cf5c-46e0-b2a1-712a8595fc49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mprn74oh222h", "content": "\u300cSolarWinds Serv-U\u300d\u306bDoS\u8106\u5f31\u6027\u3001\u60aa\u7528\u3082 - \u7c73\u5f53\u5c40\u304c\u6ce8\u610f\u559a\u8d77\n\nSolarWinds\u306e\u30d5\u30a1\u30a4\u30eb\u8ee2\u9001\u30bd\u30ea\u30e5\u30fc\u30b7\u30e7\u30f3\u300cSolarWinds Serv-U\u300d\u306b\u304a\u3051\u308b\u65e2\u77e5\u306e\u8106\u5f31\u6027\u304c\u60aa\u7528\u3055\u308c\u3066\u3044\u308b\u3068\u3057\u3066\u3001\u7c73\u5f53\u5c40\u304c\u6ce8\u610f\u559a\u8d77\u3092\u884c\u3063\u305f\u3002\n\n\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\u306e\u8106\u5f31\u6027\u300cCVE-2026-28318\u300d\u304c\u5224\u660e\u3057\u3001SolarWinds\u3067\u306f\u3001\u4fee\u6b63\u30d1\u30c3\u30c1\u3068\u306a\u308b\u300c\u540c15.5.4 Hotfix 1\u300d\u3092\u73fe\u5730\u6642\u95932026\u5e746\u67084\u65e5\u306b\u30ea\u30ea\u30fc\u30b9\u3002\u3042\u308f\u305b\u3066\u30a6\u30a7\u30d6\u30a2\u30d7\u30ea\u30b1\u30fc\u30b7\u30e7\u30f3\u30d5\u30a1\u30a4\u30a2\u30a6\u30a9\u30fc\u30eb\uff08WAF\uff09\u306b\u3088\u308b\u30a2\u30af\u30bb\u30b9\u5236\u9650\u306a\u3069\u7de9\u548c\u7b56\u3092\u6848\u5185\u3057\u3066\u3044\u308b\u3002\n\n\u7c73\u30b5\u30a4\u30d0\u30fc\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30a4\u30f3\u30d5\u30e9\u30b9\u30c8\u30e9\u30af\u30c1\u30e3\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5e81\uff08CIS...", "creation_timestamp": "2026-07-03T22:53:17.375420Z"}, {"uuid": "311e5003-fa38-4375-a011-be3d313be874", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://bsky.app/profile/getpokemon7.bsky.social/post/3mprnrubr6k2h", "content": "SolarWinds Serv-U\u306e\u8106\u5f31\u6027\u304c\u5b9f\u969b\u306b\u60aa\u7528\u3055\u308c\u308b\n\nCVE-2026-28318\uff08CVSS\u30b9\u30b3\u30a27.5\uff09\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308b\u3053\u306e\u30d0\u30b0\u306f\u3001\u7279\u5225\u306b\u7d30\u5de5\u3055\u308c\u305fPOST\u30ea\u30af\u30a8\u30b9\u30c8\u3092\u4ecb\u3057\u3066\u60aa\u7528\u3055\u308c\u3001Serv-U\u30b5\u30fc\u30d3\u30b9\u3092\u30af\u30e9\u30c3\u30b7\u30e5\u3055\u305b\u308b\u53ef\u80fd\u6027\u306e\u3042\u308b\u30b5\u30fc\u30d3\u30b9\u62d2\u5426\uff08DoS\uff09\u653b\u6483\u306e\u554f\u984c\u3068\u3057\u3066\u8aac\u660e\u3055\u308c\u3066\u3044\u307e\u3059\u3002\n\nSolarWinds\u793e\u306f\u6728\u66dc\u65e5 \u3001\u3053\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4e0a\u306e\u6b20\u9665\u3092\u60aa\u7528\u3059\u308b\u306e\u306b\u8a8d\u8a3c\u306f\u4e0d\u8981\u3060\u3068\u8b66\u544a\u3057\u305f\u3002\n\n\u3053\u306e\u4e0d\u5177\u5408\u306f\u3001Serv-U 15.5.4 Hotfix 1\u3067\u4fee\u6b63\u3055\u308c\u307e\u3057\u305f\u3002SolarWinds\u306f\u3001Serv-U 15.5.4\u306b\u6700\u8fd1\u30a2\u30c3\u30d7\u30b0\u30ec\u30fc\u30c9\u3057\u305f\u304a\u5ba2\u69d8\u3092\u542b\u3081\u3001\u3059\u3079\u3066\u306e\u304a\u5ba2\u69d8\u306b\u3053\u306e...", "creation_timestamp": "2026-07-03T23:03:51.201310Z"}, {"uuid": "3a5f7cad-8615-49b3-af63-144e87bdb0b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28185", "type": "published-proof-of-concept", "source": "https://t.me/captainsmok3r_official/433", "content": "--code: An authorization code already issued by Google (or a fake provider) for an unverified identity.\nTo obtain this --code, simply go to the wp-login.php page and click \"login with Google.\" Then, select the Gmail account you want to use to authorize the admin user access. after that, you will be redirected back to the website, and you will see something like this in the URL:\n\nsite.com/wp-login.php?code=...&state=...\n -> ?code= ...\n--code ...\n?code=...\npython poc-cve-2026-28185.py --host https://site.com/ --code ... --username admin@site.com\n\n \u203c\ufe0f this poc doesn\u2019t require authentication, but you do need to have the admin\u2019s email address of the website(for wp-login.php), and that email address must already exist as an admin account. That makes the process a bit difficult.", "creation_timestamp": "2026-08-18T03:00:03.033860Z"}, {"uuid": "6973effd-f99d-4652-83ae-23185c41745e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28744", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mpw2h4rxvw27", "content": "\ud83d\udfe0 CVE-2026-28744 - High (8.1)\n\nGitea versions up to and including 1.26.1 allow Git smart HTTP requests authenticated with bearer...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-28744/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-05T17:01:01.820260Z"}, {"uuid": "c346f218-d495-49ac-b8f2-f4668d29bbfb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28699", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mpw5rqbag62f", "content": "\ud83d\udfe0 CVE-2026-28699 - High (8.1)\n\nGitea versions up to and including 1.26.1 allow OAuth2 access token scope enforcement to be bypas...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-28699/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-05T18:00:39.018489Z"}, {"uuid": "0d55a552-9466-4211-9541-339fd12adf20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28737", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mpweilsl2s24", "content": "\ud83d\udfe0 CVE-2026-28737 - High (8.7)\n\nGitea versions from 1.25.0 before 1.26.0 allow stored cross-site scripting through the extensions...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-28737/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-05T20:00:48.713636Z"}, {"uuid": "950a97a2-45c8-4f69-8a91-b7436d35432c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/1ThaDno_W3Ka2b0qcRhQY27-XNg8SeWiGEBhbywH0dvG480h", "content": "", "creation_timestamp": "2026-08-22T00:00:29.544977Z"}, {"uuid": "21d81aeb-204b-45c8-a7a5-7da565694eef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/b4WBtRo620bcBWWOg8X_RfJcTN35itwU9g11mGhdE2NlcRcc", "content": "", "creation_timestamp": "2026-08-22T00:00:29.734125Z"}, {"uuid": "797bac84-4a2f-479f-8832-f1ffa7fcd2ed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28979", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260706", "content": "", "creation_timestamp": "2026-07-06T05:55:45.568450Z"}, {"uuid": "aa305067-1b2b-4af2-9edb-27b2d4389c1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28947", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260818", "content": "", "creation_timestamp": "2026-08-18T04:45:12.797624Z"}, {"uuid": "4a5578a9-befa-42ba-8b8f-3cda4ad965a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28958", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260818", "content": "", "creation_timestamp": "2026-08-18T04:45:15.024467Z"}, {"uuid": "89ce69f0-12ee-4ba2-8945-2eec992b8472", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28973", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260818", "content": "", "creation_timestamp": "2026-08-18T04:45:17.261221Z"}, {"uuid": "a1b7ad31-00a2-43b4-8058-d0eab0553c56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28979", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260818", "content": "", "creation_timestamp": "2026-08-18T04:45:19.485036Z"}, {"uuid": "de277282-0dda-4b4c-aa95-5d1c3d2e90b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28984", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260818", "content": "", "creation_timestamp": "2026-08-18T04:45:21.695680Z"}, {"uuid": "4b6e329e-0ca0-43e1-abb8-7676a9b20249", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28990", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260818", "content": "", "creation_timestamp": "2026-08-18T04:45:23.923763Z"}, {"uuid": "6f97b956-4ad8-477f-92f1-a3096430815e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28996", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260818", "content": "", "creation_timestamp": "2026-08-18T04:45:26.356301Z"}, {"uuid": "d9e541ce-ffec-4894-9c9b-5342238e61b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://t.me/lobushkinflash/18578", "content": "Apple \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0432\u043d\u0435\u043f\u043b\u0430\u043d\u043e\u0432\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f iOS \u0438 iPadOS, \u0437\u0430\u043a\u0440\u044b\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-28950, \u0438\u0437-\u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f, \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435, \u043c\u043e\u0433\u043b\u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0421\u041c\u0418, \u0438\u043c\u0435\u043d\u043d\u043e \u0447\u0435\u0440\u0435\u0437 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u0424\u0411\u0420 \u0441\u043c\u043e\u0433\u043b\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f Signal \u0441 iPhone \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u0435\u043c\u043e\u0433\u043e, \u0434\u0430\u0436\u0435 \u043f\u043e\u0441\u043b\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. Signal \u043f\u043e\u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u0438\u043b Apple \u0437\u0430 \u0431\u044b\u0441\u0442\u0440\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u2014 Bleeping Computer\n\n#Signal #Apple #cybersecurity", "creation_timestamp": "2026-08-07T00:17:18.533274Z"}, {"uuid": "0e0f3412-4d3c-4465-a097-1689f916301c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28699", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mpxqhwrilo2t", "content": "CVE-2026-28699 - High severity supply chain attack in Gitea. OAuth2 scope bypass via HTTP Basic auth. CVSS 8.1. Unpatched. Update immediately if using affected versions. #CVE #Gitea #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-28699/", "creation_timestamp": "2026-07-06T09:07:50.372255Z"}, {"uuid": "a0611b17-831b-4916-807d-969ff95bb75b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28309", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mssyost5x22h", "content": "\ud83d\udccc CVE-2026-28309 - SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The... https://www.cyberhub.blog/cves/CVE-2026-28309", "creation_timestamp": "2026-08-11T16:07:07.431216Z"}, {"uuid": "1e9ab679-4610-431e-9e4f-a066916b7f84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28002", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/flg4mb36qugog", "content": "CVE-2026-28002 - WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability\nCVE ID : CVE-2026-28002\n \n Published : Aug. 13, 2026, 1:42 p.m. | 30\u00a0minutes ago\n \n Description : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability ...", "creation_timestamp": "2026-08-13T14:44:43.111953Z"}, {"uuid": "9eb39195-e596-4a8c-8014-0a368bbb942c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28001", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msxvurl7ur2c", "content": "CVE-2026-28001\nWP Directory Kit versions 1.5.4 and below are vulnerable to SQL injection attacks. This means an attacker can potentially access or manipulate sensitive data without needing a password. To stay safe, update to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-13T15:00:05.000347Z"}, {"uuid": "19aa258a-ea66-44ac-9862-118b7a259705", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28008", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msxvuszsa22b", "content": "CVE-2026-28008\nAn outdated version of the WordPress OAuth plugin allows anyone to access protected areas without a password. This can lead to unauthorized changes or data theft. Update the plugin to the latest version to fix\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-13T15:00:06.263787Z"}, {"uuid": "e067ebc4-ccd1-4c85-acaa-c65709a3711c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28142", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msxwgn54x22j", "content": "CVE-2026-28142\nA security flaw in Web Directory Free allows hackers to access sensitive data without a password. This can happen if you're using a version of Web Directory Free older than 1.7.13. To stay safe, update to the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-13T15:10:04.366738Z"}, {"uuid": "a6896054-31df-4cf6-a499-d111fbd25f62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28148", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msxwgoos6a25", "content": "CVE-2026-28148\nIf you're using Headless Single Sign On, versions up to 1.6 have a security weakness. This means someone could access your system without needing a password, which could lead to unauthorized changes or data\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-13T15:10:05.697903Z"}, {"uuid": "d87015c9-458f-44b4-b807-56b79654173d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28149", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msxwyjpojk2e", "content": "CVE-2026-28149\nA security weakness in older versions of Headless Single Sign On allows an attacker to inject malicious PHP code without needing a password. This could potentially allow an attacker to access sensitive data or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-13T15:20:04.794996Z"}, {"uuid": "cdec873e-5649-4375-bfcc-e0509b09a742", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28185", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3msxwylaa5f2e", "content": "CVE-2026-28185\nIf you use Log in with Google to authenticate users, versions up to 1.4.2 have a security issue. An attacker can potentially bypass login requirements and gain unauthorized access to your application. Update to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-08-13T15:20:05.975528Z"}, {"uuid": "7fb3abc9-4e95-4656-86ab-05dcfafd8abd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28316", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mst7fejbrg2e", "content": "\ud83d\udccc CVE-2026-28316 - SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administra... https://www.cyberhub.blog/cves/CVE-2026-28316", "creation_timestamp": "2026-08-11T18:07:06.706603Z"}, {"uuid": "4aabb50f-b294-4574-8c93-d62b00c4eb0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28947", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2020", "content": "", "creation_timestamp": "2026-08-18T08:45:10.579454Z"}, {"uuid": "57ad8491-2c55-4b3b-9d3f-b3539cabf2e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28958", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2020", "content": "", "creation_timestamp": "2026-08-18T08:45:12.844410Z"}, {"uuid": "fde562ed-5c58-4691-aecc-9fd76398976a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28973", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2020", "content": "", "creation_timestamp": "2026-08-18T08:45:15.111750Z"}, {"uuid": "36d4eaa8-657a-4588-b05b-42cee1f65f4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28979", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2020", "content": "", "creation_timestamp": "2026-08-18T08:45:17.732372Z"}, {"uuid": "ea976428-f0a6-4978-a46f-20984571de84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28984", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2020", "content": "", "creation_timestamp": "2026-08-18T08:45:19.986226Z"}, {"uuid": "2e28027a-5008-4bf8-8492-23a68a0218c6", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28409", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/61b62538-444c-4b6f-a8a3-edacf6556746", "content": "", "creation_timestamp": "2026-08-07T01:10:51.642718Z"}, {"uuid": "961772d5-6f53-4f25-9e95-9682e6d23d7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28990", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2020", "content": "", "creation_timestamp": "2026-08-18T08:45:22.204970Z"}, {"uuid": "aeca55c1-f689-408e-914d-83755e3b0870", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28996", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=2020", "content": "", "creation_timestamp": "2026-08-18T08:45:24.428736Z"}, {"uuid": "d459d9c1-de3f-4643-8722-07440fb1f0c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28564", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbyj7nlat2y", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-28564: \u041e\u0431\u0445\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0441\u0435\u0430\u043d\u0441\u043e\u0432 \u0438 \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u044b\u0439 \u0441\u0440\u043e\u043a \u0438\u0445 \u0438\u0441\u0442\u0435\u0447\u0435\u043d\u0438\u044f\n\n\n\nhttps://kripta.biz/posts/3D444A2D-C8F4-4CCE-91E9-277D532EB417", "creation_timestamp": "2026-07-10T10:58:20.545461Z"}, {"uuid": "4c850b2d-af81-4dec-a392-f617553ae118", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28564", "type": "seen", "source": "https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-28564", "content": "", "creation_timestamp": "2026-07-10T12:15:27.341242Z"}, {"uuid": "4a8c6960-348f-48c4-b941-3dfe38b671ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28564", "type": "seen", "source": "https://bsky.app/profile/infosec.skyfleet.blue/post/3mqc7usyeg62t", "content": "CVE-2026-28564: Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials", "creation_timestamp": "2026-07-10T13:10:06.957715Z"}, {"uuid": "6c4f174d-00b6-49b5-9c11-ec26e0dd32e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28564", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqcpcbxgk52v", "content": "CVE-2026-28564 - apache iotdb\nApache IoTDB, a database for IoT data, has a security issue that allows attackers to use old login credentials. This means that if someone steals your login\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apacheiotdb #apachefoundation #CVE #infosec", "creation_timestamp": "2026-07-10T17:46:04.415014Z"}, {"uuid": "2a8b78ee-5f45-44da-8933-17da8137ba7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28564", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd2imjmc52s", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-28564: \u041e\u0431\u0445\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0441\u0435\u0430\u043d\u0441\u043e\u0432\n\n\n\nhttps://kripta.biz/posts/2CABAAA4-49A2-4CA7-BA66-B455654F05C3", "creation_timestamp": "2026-07-10T21:06:27.746144Z"}, {"uuid": "0045d7d3-cefa-4302-80ef-6ca044b376f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28564", "type": "seen", "source": "https://bsky.app/profile/kriptabiz.bsky.social/post/3mqd5aj77bx2a", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-28564: \u041e\u0431\u0445\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0447\u0435\u0440\u0435\u0437 \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442 \u0441\u0435\u0441\u0441\u0438\u0439\n\n\n\nhttps://kripta.biz/posts/D82AC355-E2C7-4B70-9069-993734DFE0C8", "creation_timestamp": "2026-07-10T21:55:37.117962Z"}, {"uuid": "662b04e9-2086-4e9e-8c26-cd9366831aaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28711", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/30370", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, selected to avoid duplicates and outdated entries.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-31452\n\ud83c\udfaf OpenCart \u2013 Arbitrary File Upload \u2192 RCE\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/exploitblizzard/CVE-2026-31452\n\n\ud83e\udde0 Overview\nA vulnerability in OpenCart allows attackers to upload arbitrary files without proper validation, leading to remote code execution on the server.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Full web server compromise\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-30121\n\ud83c\udfaf Zimbra Collaboration \u2013 Authentication Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/ry4n-h/CVE-2026-30121\n\n\ud83e\udde0 Overview\nA flaw in Zimbra allows attackers to bypass authentication mechanisms and gain unauthorized access to user accounts.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Account takeover\n\u2022 Email system compromise\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-28711\n\ud83c\udfaf Jenkins \u2013 Script Console Abuse\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/wh0amitz/CVE-2026-28711\n\n\ud83e\udde0 Overview\nA vulnerability in Jenkins enables attackers to execute arbitrary scripts through misconfigured or exposed script console endpoints.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 CI/CD pipeline compromise\n\u2022 Credential exposure\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-27654\n\ud83c\udfaf Drupal Module \u2013 SQL Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/0xM4hmoud/CVE-2026-27654\n\n\ud83e\udde0 Overview\nA SQL injection vulnerability in a Drupal module allows attackers to manipulate database queries and extract sensitive data.\n\n\u2699\ufe0f Impact\n\u2022 Database compromise\n\u2022 Data leakage\n\u2022 Privilege escalation\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-26590\n\ud83c\udfaf Node.js Application \u2013 Prototype Pollution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/s4vitar/CVE-2026-26590\n\n\ud83e\udde0 Overview\nA prototype pollution vulnerability allows attackers to modify application logic by injecting malicious object properties.\n\n\u2699\ufe0f Impact\n\u2022 Application logic manipulation\n\u2022 Potential RCE chain\n\u2022 Security control bypass\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Exploit development\n\u2022 Patch analysis\n\u2022 Vulnerability chain study\n\u2022 Red / Blue Team training\n\n\u26a0\ufe0f Ethical Notice\nThis information is provided for cybersecurity research and defensive purposes only.\nDo not use it for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:36.050991Z"}, {"uuid": "e819d870-2e7f-4461-9239-51be07adffe8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28792", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/30458", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, selected to avoid duplicates and previously shared entries.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-33321\n\ud83c\udfaf vBulletin \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/whitehatsk/CVE-2026-33321\n\n\ud83e\udde0 Overview\nA vulnerability in vBulletin allows attackers to execute arbitrary code via crafted requests targeting improperly validated input parameters.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Web forum compromise\n\u2022 Full server takeover\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-32014\n\ud83c\udfaf Liferay Portal \u2013 Authentication Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/ColdFusionX/CVE-2026-32014\n\n\ud83e\udde0 Overview\nA flaw in Liferay Portal allows attackers to bypass authentication and gain unauthorized access to restricted resources.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Privileged access\n\u2022 Enterprise portal compromise\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-30977\n\ud83c\udfaf PrestaShop \u2013 SQL Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/0xInfection/CVE-2026-30977\n\n\ud83e\udde0 Overview\nA SQL injection vulnerability in PrestaShop enables attackers to manipulate database queries through crafted input.\n\n\u2699\ufe0f Impact\n\u2022 Database compromise\n\u2022 Sensitive data exposure\n\u2022 Privilege escalation\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-29866\n\ud83c\udfaf Flask-Based Application \u2013 Template Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/d3vilbug/CVE-2026-29866\n\n\ud83e\udde0 Overview\nA server-side template injection vulnerability allows attackers to execute arbitrary code via unsanitized user input.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Application compromise\n\u2022 Data exposure\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-28792\n\ud83c\udfaf Magento \u2013 Arbitrary File Upload\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/blackhatsociety/CVE-2026-28792\n\n\ud83e\udde0 Overview\nA vulnerability in Magento allows attackers to upload malicious files, leading to remote code execution on the server.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Full system compromise\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Vulnerability research\n\u2022 Exploit development\n\u2022 Patch analysis\n\u2022 Red team / blue team exercises\n\n\u26a0\ufe0f Ethical Notice\nThis content is shared for cybersecurity research and defensive purposes only.\nDo not use this information for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-16T00:00:36.412920Z"}, {"uuid": "b75b760a-441b-4e3b-9457-011918a878e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28699", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/88282", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a gitea-CVE-2026-28699\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Alardiians\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-11 02:40:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLab + writeup for CVE-2026-28699: Gitea OAuth2 scope enforcement bypass via HTTP Basic auth\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-12T07:00:04.447540Z"}, {"uuid": "38d621ac-8199-4c67-b802-d6de336415d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/88541", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-28318-check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BishopFox\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-12 20:38:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSafely detect whether a SolarWinds Serv-U host is vulnerable to CVE-2026-28318\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-12T07:00:05.081811Z"}, {"uuid": "86280884-a8d3-4c31-9820-1cc81abb0c8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/88157", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a servu-cve-2026-28318-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a EaEa0001\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-10 07:03:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSolarWinds Serv-U CVE-2026-28318: unauthenticated Content-Encoding: deflate crash. Root-cause analysis (invalid free of an interior pointer -> heap corruption) + DoS-only PoC. Fixed in 15.5.4 Hotfix 1.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-12T10:00:04.010964Z"}, {"uuid": "6800ab08-afc0-40e4-96c8-383910e01cd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/88157", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a servu-cve-2026-28318-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a EaEa0001\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-10 07:03:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSolarWinds Serv-U CVE-2026-28318: unauthenticated Content-Encoding: deflate crash. Root-cause analysis (invalid free of an interior pointer -> heap corruption) + DoS-only PoC. Fixed in 15.5.4 Hotfix 1.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T00:00:46.444672Z"}, {"uuid": "dc92a656-31c0-49ea-a0fe-c820a0e6fb8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28699", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/88282", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a gitea-CVE-2026-28699\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Alardiians\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-11 02:40:24\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLab + writeup for CVE-2026-28699: Gitea OAuth2 scope enforcement bypass via HTTP Basic auth\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T00:00:49.720465Z"}, {"uuid": "20ae7e8c-3439-4009-9f1a-efe65d377724", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/88541", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-28318-check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a BishopFox\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-06-12 20:38:38\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSafely detect whether a SolarWinds Serv-U host is vulnerable to CVE-2026-28318\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T00:00:50.382985Z"}, {"uuid": "21fb0b55-89c8-4bae-a79f-c793d82d10e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28867", "type": "seen", "source": "https://t.me/GithubRedTeam/91976", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-28867-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a speedyfriend433\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 02:48:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nKernel info leak Proof of Concept patched in iOS 26.4 / macOS 26.4\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-13T22:00:12.839945Z"}, {"uuid": "970ab958-81e7-4fb2-8141-71d314cbce53", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28867", "type": "seen", "source": "https://t.me/GithubRedTeam/91976", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-28867-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a speedyfriend433\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 02:48:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nKernel info leak Proof of Concept patched in iOS 26.4 / macOS 26.4\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-14T00:00:20.848263Z"}, {"uuid": "dc2f7064-44d1-446e-a834-2494e86c5cea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28519", "type": "seen", "source": "https://bsky.app/profile/secqube.com/post/3mtgghda2562f", "content": "CVE-2026-28519 - arduino-TuyaOpen DnsServer Heap-Based Buffer Overflow Remote Code Execution scq.ms/4dmCSIc", "creation_timestamp": "2026-08-19T09:34:03.451051Z"}, {"uuid": "a6bdbfdf-4765-4e9f-8195-9e1ab1038193", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28173", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3msyr77evow26", "content": "CVE-2026-28173 - Arbitrary content deletion in WP Event Solution <= 4.1.19. CVSS 7.1. Unpatched - check your installs and restrict access now. #CVE #WordPress #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-28173/", "creation_timestamp": "2026-08-13T23:09:29.239322Z"}, {"uuid": "665f5482-aac0-48a7-a21d-fcf9ba40d62f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28173", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117090716845809583", "content": "CVE-2026-28173 - Arbitrary content deletion in WP Event Solution <= 4.1.19. CVSS 7.1. Unpatched - check your installs and restrict access now. #CVE #WordPress #infosec\nhttps://www.valtersit.com/cve/CVE-2026-28173/", "creation_timestamp": "2026-08-13T23:09:44.367617Z"}, {"uuid": "b1605d68-36b5-47bd-8c03-2323b596a51d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28867", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/91976", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-28867-PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a speedyfriend433\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 02:48:06\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nKernel info leak Proof of Concept patched in iOS 26.4 / macOS 26.4\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-15T00:00:29.374395Z"}, {"uuid": "4fe6042a-12f9-4b88-8684-8837134fd133", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28145", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3msixbjsnbw2i", "content": "CVE-2026-28145 masterstudy-lms-learning-management-system (CVSS Score 5.3) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept", "creation_timestamp": "2026-08-07T16:15:10.979744Z"}, {"uuid": "e71b1eec-db37-4ceb-9046-4860a382c51b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28323", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117055370733606045", "content": "This post is from yesterday.\nNote: Arctic Wolf will sell your data without consent. you need to scroll to the bottom and opt out of being sold to unscrupulous third-parties. \nArctic Wolf: SolarWinds Web Help Desk Vulnerabilities: CVE-2026-28323 and CVE-2026-28299 https://arcticwolf.com/resources/blog/cve-2026-28323-and-cve-2026-28299/ #infosec #vulnerability #privacy", "creation_timestamp": "2026-08-07T17:20:12.088822Z"}, {"uuid": "0aa94d4f-4214-44e2-814b-0de8b5ebb230", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "seen", "source": "https://t.me/thehackernews/9168", "content": "\ud83d\udea8 A SolarWinds Serv-U bug is now on CISA\u2019s exploited list.\n\nCVE-2026-28318 can let unauthenticated requests crash the file server.\n\nPatch: Serv-U 15.5.4 HF1.\n\nFederal agencies have until June 19, 2026.\n\nRead: https://thehackernews.com/2026/06/cisa-adds-actively-exploited-solarwinds.html", "creation_timestamp": "2026-07-15T12:00:05.526809Z"}, {"uuid": "4d45a03f-0f99-4313-bf0f-9d3bb583dd9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28165", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtthnmqns72p", "content": "CVE-2026-28165 - digits\nWebsites that use the Digits extra feature for WordPress, up to version 9.2, can be accessed by anyone on the internet who can then gain administrator privileges. This could let an\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#digits #unitedover #CVE #infosec", "creation_timestamp": "2026-08-24T14:00:05.260561Z"}, {"uuid": "563d052b-fb9d-4350-b92f-7e2d0ed2564a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28318", "type": "exploited", "source": "https://t.me/thehackernews/9168", "content": "\ud83d\udea8 A SolarWinds Serv-U bug is now on CISA\u2019s exploited list.\n\nCVE-2026-28318 can let unauthenticated requests crash the file server.\n\nPatch: Serv-U 15.5.4 HF1.\n\nFederal agencies have until June 19, 2026.\n\nRead: https://thehackernews.com/2026/06/cisa-adds-actively-exploited-solarwinds.html", "creation_timestamp": "2026-07-16T00:00:09.059780Z"}, {"uuid": "2ddde836-24ef-4683-aa5f-85c44bcfda4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28165", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtti2gqccx23", "content": "\ud83d\udea8 CVE-2026-28165 \u2014 CVSS 9.8 CRITICAL\n\nUnauthenticated Privilege Escalation in Digits <= 9.2 versions.\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-28165\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-24T14:07:15.097586Z"}, {"uuid": "cc7bb3a8-28fa-4be9-8969-ca58d86acbdc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28582", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:04.724043Z"}, {"uuid": "846bd2ca-c838-4f69-9398-78f43c5adfac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28584", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:09.112816Z"}, {"uuid": "463d331e-3eed-4a4a-8c8c-90ff5028a7bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28585", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:11.297737Z"}, {"uuid": "613dc3db-5d83-4930-a618-e08da2813cba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28583", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:06.904378Z"}, {"uuid": "2694d264-8dc4-420b-b2b5-fc5e300ac833", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28590", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:13.675639Z"}, {"uuid": "907b6690-2182-44ab-8162-aeebc9638863", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28594", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:15.924625Z"}, {"uuid": "be0a4e7b-4fb3-463d-a726-46d89bbf360a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28596", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:18.140911Z"}, {"uuid": "1fbd70c5-fe64-4cb0-a24c-c087f4dd2814", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28599", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:20.336147Z"}, {"uuid": "acdea511-4e76-473a-a35b-d65896e83ee1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28600", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:22.516672Z"}, {"uuid": "0dc7ceba-54f8-40f9-a286-dafc4e857006", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28602", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:24.887354Z"}, {"uuid": "cf535e19-5dc6-4927-9105-d2bfd72e77a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28603", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:27.121023Z"}, {"uuid": "46ffc703-af12-4799-a505-8a5e7f0a2a6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28606", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:29.302205Z"}, {"uuid": "211ae6b0-8645-4d87-a578-08ffd5df12ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28612", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:31.477593Z"}, {"uuid": "fba1d514-5d73-4f3f-9187-963acb1255b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28614", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:33.646434Z"}, {"uuid": "398c468e-da93-4346-b678-62e089e757be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28618", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:35.815248Z"}, {"uuid": "a7032d5c-7946-4c5f-8c75-92234d830207", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28623", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:37.974047Z"}, {"uuid": "e9a5b6fd-a604-46c2-98c5-e50cc71fe30d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28624", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:40.142739Z"}, {"uuid": "a8d12208-1b59-4f7c-9361-5c5fe29bf444", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28630", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:42.329174Z"}, {"uuid": "72ac4a8e-3658-451e-afcf-91b3bc455e6c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28631", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:44.772766Z"}, {"uuid": "52dffec1-4709-4db6-bc26-f93c88a7475b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28632", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:46.959280Z"}, {"uuid": "320180e9-7660-4f2a-8543-5a8e8a8b3791", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28633", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:49.457569Z"}, {"uuid": "b8a7ac34-d0e6-4698-a292-583440214deb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28634", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:51.684333Z"}, {"uuid": "c0a4518b-c9ff-490c-833f-48c915d6ca12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28638", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:53.866262Z"}, {"uuid": "61cae7fa-652b-42ba-b673-752af592f6ee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28639", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:56.040941Z"}, {"uuid": "72d08869-0724-49a5-9df4-e0cdd55cd6b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28642", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:46:58.209899Z"}, {"uuid": "992e4665-4f31-441f-9992-bc5f1c331b85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28644", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:47:00.376517Z"}, {"uuid": "7fce9dd6-fe97-4e11-8393-f535da32a956", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28649", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:47:03.558876Z"}, {"uuid": "0791fb6c-9ae3-4d9c-8082-dec4a346c2e9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28650", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/samsung-products-multiple-vulnerabilities_20260716", "content": "", "creation_timestamp": "2026-07-16T04:47:05.731573Z"}, {"uuid": "5e98107f-1f92-4e06-815e-4b754e3ceb34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28292", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17066", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are fresh CVE PoC repositories actively updated or recently surfaced on GitHub, selected to avoid duplicates and outdated entries.\n\n1\ufe0f\u20e3 CVE-2026-20841\n\ud83c\udfaf Windows Notepad \u2013 Potential RCE (PoC)\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/BTtea/CVE-2026-20841-PoC\n\n\ud83e\udde0 Overview\nA Proof-of-Concept targeting Windows Notepad (< 11.2510) demonstrates a possible remote code execution scenario through crafted input handling.\n\n\u2699\ufe0f Impact\n\u2022 Potential RCE vector\n\u2022 Local exploitation scenario\n\u2022 Early-stage PoC (research-focused)\n\n\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-28292\n\ud83c\udfaf simple-git (Node.js) \u2013 Remote Code Execution\n\n\ud83e\udde0 Overview\nA critical vulnerability in the widely used simple-git library allows attackers to achieve remote code execution due to improper case-sensitive validation in security logic.\nA single missing regex flag allows bypass of previous security patches.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Patch bypass\n\u2022 Affects millions of installations\n\n\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-29000\n\ud83c\udfaf pac4j-jwt \u2013 Authentication Bypass (CVSS 10)\n\n\ud83e\udde0 Overview\nA critical flaw in pac4j-jwt allows attackers to forge authentication tokens using only a public key, enabling full account takeover.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Admin account takeover\n\u2022 CVSS 10.0 Critical\n\n\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-21858\n\ud83c\udfaf n8n Workflow \u2013 Critical Vulnerability Detection / Exploit Path\n\n\ud83d\udd17 GitHub Topic\nhttps://github.com/topics/cve-2026-21858\n\n\ud83e\udde0 Overview\nA critical vulnerability affecting n8n workflow automation platforms, with tools and PoC-related detection scripts available on GitHub.\n\n\u2699\ufe0f Impact\n\u2022 Workflow compromise\n\u2022 Automation abuse\n\u2022 CVSS 10.0\n\n\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-XXXX (Fresh Aggregated PoC Stream)\n\ud83c\udfaf Live GitHub PoC Feed (Auto-Collected CVEs)\n\n\ud83d\udd17 Repository\nhttps://github.com/nomi-sec/PoC-in-GitHub\n\n\ud83e\udde0 Overview\nThis repository continuously collects newly published CVE PoCs across GitHub, making it one of the most reliable sources for real-time vulnerability tracking.\n\n\u2699\ufe0f Impact\n\u2022 Continuous PoC discovery\n\u2022 Daily vulnerability tracking\n\u2022 Research automation source\n\n\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\nThese entries are useful for:\n\u2022 Tracking real PoC release timing\n\u2022 Studying patch bypass techniques\n\u2022 Monitoring emerging exploit trends\n\u2022 Building automated CVE intelligence pipelines\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive analysis only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:08.690499Z"}, {"uuid": "2d6610b5-fe32-4499-b145-628d60f93b83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28711", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17097", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, selected to avoid duplicates and outdated entries.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-31452\n\ud83c\udfaf OpenCart \u2013 Arbitrary File Upload \u2192 RCE\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/exploitblizzard/CVE-2026-31452\n\n\ud83e\udde0 Overview\nA vulnerability in OpenCart allows attackers to upload arbitrary files without proper validation, leading to remote code execution on the server.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Full web server compromise\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-30121\n\ud83c\udfaf Zimbra Collaboration \u2013 Authentication Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/ry4n-h/CVE-2026-30121\n\n\ud83e\udde0 Overview\nA flaw in Zimbra allows attackers to bypass authentication mechanisms and gain unauthorized access to user accounts.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Account takeover\n\u2022 Email system compromise\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-28711\n\ud83c\udfaf Jenkins \u2013 Script Console Abuse\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/wh0amitz/CVE-2026-28711\n\n\ud83e\udde0 Overview\nA vulnerability in Jenkins enables attackers to execute arbitrary scripts through misconfigured or exposed script console endpoints.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 CI/CD pipeline compromise\n\u2022 Credential exposure\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-27654\n\ud83c\udfaf Drupal Module \u2013 SQL Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/0xM4hmoud/CVE-2026-27654\n\n\ud83e\udde0 Overview\nA SQL injection vulnerability in a Drupal module allows attackers to manipulate database queries and extract sensitive data.\n\n\u2699\ufe0f Impact\n\u2022 Database compromise\n\u2022 Data leakage\n\u2022 Privilege escalation\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-26590\n\ud83c\udfaf Node.js Application \u2013 Prototype Pollution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/s4vitar/CVE-2026-26590\n\n\ud83e\udde0 Overview\nA prototype pollution vulnerability allows attackers to modify application logic by injecting malicious object properties.\n\n\u2699\ufe0f Impact\n\u2022 Application logic manipulation\n\u2022 Potential RCE chain\n\u2022 Security control bypass\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Exploit development\n\u2022 Patch analysis\n\u2022 Vulnerability chain study\n\u2022 Red / Blue Team training\n\n\u26a0\ufe0f Ethical Notice\nThis information is provided for cybersecurity research and defensive purposes only.\nDo not use it for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:09.787089Z"}, {"uuid": "621c7602-6257-4744-9bb8-866f77ff86d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28792", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17104", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, selected to avoid duplicates and previously shared entries.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-33321\n\ud83c\udfaf vBulletin \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/whitehatsk/CVE-2026-33321\n\n\ud83e\udde0 Overview\nA vulnerability in vBulletin allows attackers to execute arbitrary code via crafted requests targeting improperly validated input parameters.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Web forum compromise\n\u2022 Full server takeover\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-32014\n\ud83c\udfaf Liferay Portal \u2013 Authentication Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/ColdFusionX/CVE-2026-32014\n\n\ud83e\udde0 Overview\nA flaw in Liferay Portal allows attackers to bypass authentication and gain unauthorized access to restricted resources.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Privileged access\n\u2022 Enterprise portal compromise\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-30977\n\ud83c\udfaf PrestaShop \u2013 SQL Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/0xInfection/CVE-2026-30977\n\n\ud83e\udde0 Overview\nA SQL injection vulnerability in PrestaShop enables attackers to manipulate database queries through crafted input.\n\n\u2699\ufe0f Impact\n\u2022 Database compromise\n\u2022 Sensitive data exposure\n\u2022 Privilege escalation\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-29866\n\ud83c\udfaf Flask-Based Application \u2013 Template Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/d3vilbug/CVE-2026-29866\n\n\ud83e\udde0 Overview\nA server-side template injection vulnerability allows attackers to execute arbitrary code via unsanitized user input.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Application compromise\n\u2022 Data exposure\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-28792\n\ud83c\udfaf Magento \u2013 Arbitrary File Upload\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/blackhatsociety/CVE-2026-28792\n\n\ud83e\udde0 Overview\nA vulnerability in Magento allows attackers to upload malicious files, leading to remote code execution on the server.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Full system compromise\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Vulnerability research\n\u2022 Exploit development\n\u2022 Patch analysis\n\u2022 Red team / blue team exercises\n\n\u26a0\ufe0f Ethical Notice\nThis content is shared for cybersecurity research and defensive purposes only.\nDo not use this information for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:10.062707Z"}, {"uuid": "dbdbc9c3-b6ce-446a-9ab8-5677d97cf4c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/1_b90yBOy2SfvjuZ69uWqxo4lLXWTFoL87sqOYfdotwyiTZa", "content": "", "creation_timestamp": "2026-08-24T17:00:03.459075Z"}, {"uuid": "d4073ed5-55e2-4b16-96a9-ef00a0b7c9b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28995", "type": "seen", "source": "Telegram/XjrNCelxX9XYIj6aBUG9_DViyRThtT0IoD7s9xRL3gDQjhs", "content": "", "creation_timestamp": "2026-07-16T19:00:23.100697Z"}, {"uuid": "1c7047f1-af17-4184-8e13-9bcb36fcaeb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28992", "type": "seen", "source": "Telegram/43iTBnXrMXWinJKk3NF4ciLtqjqRzzWpFXhZUpc74NxoDe4", "content": "", "creation_timestamp": "2026-07-16T19:00:13.062583Z"}, {"uuid": "af0b9abe-e07d-4e2d-98ed-ff94eed125a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/Wkw5Q93mgEWIMhhwt6CYg1p81IUQmroPxiysbO9zWQOWvyeP", "content": "", "creation_timestamp": "2026-08-24T17:00:03.710198Z"}, {"uuid": "c359024f-386c-4034-a440-a1fe27b42243", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28867", "type": "seen", "source": "Telegram/x_EE0BnflIglKTCancXDMg4DpMXKUryPfiDknYn9NGqvHWA", "content": "", "creation_timestamp": "2026-07-16T19:00:21.807085Z"}, {"uuid": "137f6c32-b3af-4a6d-b82b-e720f4d67413", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28496", "type": "seen", "source": "Telegram/ItjnC_FoWME3_hAWnOsnrDgRkC5Sqs1SuPvtN2fslLkrh58", "content": "", "creation_timestamp": "2026-07-16T19:00:27.563626Z"}, {"uuid": "a1421783-3051-4faf-8e1e-5ba25d5ca901", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/mCB2grCGFyDPyP46h0RoSTt2nzVg4a1r-qTUhzVOT_Pb_Nr6", "content": "", "creation_timestamp": "2026-08-24T17:00:03.935832Z"}, {"uuid": "0a8a6aea-7b1b-49f8-8046-95c815ba5a0e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/94zsc3RGfL-cYo-R392AxLlVEM1n1YwHAA5wklhiAnO4RRX-", "content": "", "creation_timestamp": "2026-08-24T17:00:04.156427Z"}, {"uuid": "c9c6a911-1e13-4b43-98fe-d70add43c552", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28992", "type": "seen", "source": "Telegram/43iTBnXrMXWinJKk3NF4ciLtqjqRzzWpFXhZUpc74NxoDe4", "content": "", "creation_timestamp": "2026-07-17T00:00:28.408760Z"}, {"uuid": "bdee4546-5b70-4161-ac86-dc5a1d285ee9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28867", "type": "seen", "source": "Telegram/x_EE0BnflIglKTCancXDMg4DpMXKUryPfiDknYn9NGqvHWA", "content": "", "creation_timestamp": "2026-07-17T00:00:38.288463Z"}, {"uuid": "3423e781-c1b3-49df-aac3-86f7e023f0fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28995", "type": "seen", "source": "Telegram/XjrNCelxX9XYIj6aBUG9_DViyRThtT0IoD7s9xRL3gDQjhs", "content": "", "creation_timestamp": "2026-07-17T00:00:39.660061Z"}, {"uuid": "1db718cb-191c-4736-804d-06b7a508f021", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/mVHbj7a1DYNF9kaBsr_OFLsg6Xhcx7FdBO2-7gQR_Jq3tWAA", "content": "", "creation_timestamp": "2026-08-24T17:00:04.865034Z"}, {"uuid": "3a62a7f5-bd00-471a-ba33-ac5b31a1c217", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28496", "type": "seen", "source": "Telegram/ItjnC_FoWME3_hAWnOsnrDgRkC5Sqs1SuPvtN2fslLkrh58", "content": "", "creation_timestamp": "2026-07-17T01:00:25.397113Z"}, {"uuid": "73b22a35-bad6-4f2a-a8bb-4a98fb836730", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28867", "type": "published-proof-of-concept", "source": "Telegram/x_EE0BnflIglKTCancXDMg4DpMXKUryPfiDknYn9NGqvHWA", "content": "", "creation_timestamp": "2026-07-18T00:00:22.526162Z"}, {"uuid": "8415b0ee-be8d-4448-9e45-64ec92400808", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28995", "type": "published-proof-of-concept", "source": "Telegram/XjrNCelxX9XYIj6aBUG9_DViyRThtT0IoD7s9xRL3gDQjhs", "content": "", "creation_timestamp": "2026-07-18T00:00:11.063817Z"}, {"uuid": "10e3dd83-6933-43f5-8f34-afc994227bb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28171", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mttvufexuw2i", "content": "CVE-2026-28171 - Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7. CVSS 8.6. Currently unpatched. Deactivate plugin now. #CVE #WordPress #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-28171/", "creation_timestamp": "2026-08-24T18:14:25.235469Z"}, {"uuid": "044dfb0d-8259-4018-b457-2cf9e1381fda", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28171", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117151843283303878", "content": "CVE-2026-28171 - Unauthenticated Arbitrary File Deletion in WooCommerce File Approval <= 10.7. CVSS 8.6. Currently unpatched. Deactivate plugin now. #CVE #WordPress #infosec\nhttps://www.valtersit.com/cve/CVE-2026-28171/", "creation_timestamp": "2026-08-24T18:14:47.728044Z"}, {"uuid": "a084ad8e-f531-49ae-9850-cb4859cda53b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28992", "type": "published-proof-of-concept", "source": "Telegram/43iTBnXrMXWinJKk3NF4ciLtqjqRzzWpFXhZUpc74NxoDe4", "content": "", "creation_timestamp": "2026-07-18T00:00:44.062856Z"}, {"uuid": "32d4c893-413e-445c-8ec0-b08372dae93a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28496", "type": "published-proof-of-concept", "source": "Telegram/ItjnC_FoWME3_hAWnOsnrDgRkC5Sqs1SuPvtN2fslLkrh58", "content": "", "creation_timestamp": "2026-07-18T01:00:03.985891Z"}, {"uuid": "330476ef-a4b1-4d27-88f8-2b0198947caf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28209", "type": "seen", "source": "https://t.me/cve0day/270", "content": "\ud83d\udea8 CVE-2026-28209\nFreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.\n\nhttps://github.com/FreePBX/security-reporting/security/advisories/GHSA-f558-mp87-58vj", "creation_timestamp": "2026-08-28T00:00:41.617710Z"}, {"uuid": "fecb12a0-6530-4b8e-98e8-7e2f39b36ece", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28496", "type": "published-proof-of-concept", "source": "Telegram/ItjnC_FoWME3_hAWnOsnrDgRkC5Sqs1SuPvtN2fslLkrh58", "content": "", "creation_timestamp": "2026-07-19T00:00:41.655125Z"}, {"uuid": "9fecb502-5d1b-411b-84c7-8f97094d50fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/-SvGncDmyD8mCinZhEuoCdd-YFQP5dpOrLuNh1m61f7bY1jo", "content": "", "creation_timestamp": "2026-08-23T00:00:41.238626Z"}, {"uuid": "d4f017e3-a13a-46b2-9ff3-31c07e16d2e2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28220", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mr3vllatfw2g", "content": "CVE-2026-28220 - Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node\nCVE ID : CVE-2026-28220\n \n Published : July 20, 2026, 4:16 p.m. | 18\u00a0minutes ago\n \n Description : Wazuh is ...", "creation_timestamp": "2026-07-20T18:15:12.046296Z"}, {"uuid": "dab416fc-bfb1-45ea-83c4-7526d0502577", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28516", "type": "seen", "source": "https://t.me/proxy_bar/3170", "content": "CVE-2026-28515, CVE-2026-28516, CVE-2026-28517\n*\nopenDCIM: From SQL Injection to RCE via Config Poisoning", "creation_timestamp": "2026-07-20T19:00:07.960346Z"}, {"uuid": "be1b2209-9204-4850-95fe-881453a72a58", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28515", "type": "seen", "source": "https://t.me/proxy_bar/3170", "content": "CVE-2026-28515, CVE-2026-28516, CVE-2026-28517\n*\nopenDCIM: From SQL Injection to RCE via Config Poisoning", "creation_timestamp": "2026-07-20T19:00:07.989094Z"}, {"uuid": "9d99530b-53e4-4b35-9764-a55c009d043f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28517", "type": "seen", "source": "https://t.me/proxy_bar/3170", "content": "CVE-2026-28515, CVE-2026-28516, CVE-2026-28517\n*\nopenDCIM: From SQL Injection to RCE via Config Poisoning", "creation_timestamp": "2026-07-20T19:00:08.022456Z"}, {"uuid": "997f31eb-7f36-4ef9-82ee-0fecc962240b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28292", "type": "seen", "source": "https://t.me/proxy_bar/3201", "content": "CVE-2026-28292: RCE in simple-git\n\nFull Proof of Concept", "creation_timestamp": "2026-07-20T19:00:07.797490Z"}, {"uuid": "3fadaf0d-e73e-40d2-ba73-fdbc4ef6cac1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28231", "type": "published-proof-of-concept", "source": "https://github.com/bigcat88/pillow_heif/security/advisories/GHSA-5gjj-6r7v-ph3x", "content": "", "creation_timestamp": "2026-07-20T20:35:04.660392Z"}, {"uuid": "019225b0-5f64-4c06-99ec-1401954f4d75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28517", "type": "seen", "source": "https://t.me/proxy_bar/3170", "content": "CVE-2026-28515, CVE-2026-28516, CVE-2026-28517\n*\nopenDCIM: From SQL Injection to RCE via Config Poisoning", "creation_timestamp": "2026-07-21T00:00:25.071168Z"}, {"uuid": "f9aa7522-e50e-4e32-9721-128218c41368", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28292", "type": "seen", "source": "https://t.me/proxy_bar/3201", "content": "CVE-2026-28292: RCE in simple-git\n\nFull Proof of Concept", "creation_timestamp": "2026-07-21T00:00:24.813333Z"}, {"uuid": "b3171d7c-eeb8-4c91-9bea-1d749b49af27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28516", "type": "seen", "source": "https://t.me/proxy_bar/3170", "content": "CVE-2026-28515, CVE-2026-28516, CVE-2026-28517\n*\nopenDCIM: From SQL Injection to RCE via Config Poisoning", "creation_timestamp": "2026-07-21T00:00:25.008102Z"}, {"uuid": "35f93fb3-8a93-49fd-80c6-b12f5bf2b502", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28515", "type": "seen", "source": "https://t.me/proxy_bar/3170", "content": "CVE-2026-28515, CVE-2026-28516, CVE-2026-28517\n*\nopenDCIM: From SQL Injection to RCE via Config Poisoning", "creation_timestamp": "2026-07-21T00:00:25.039511Z"}, {"uuid": "071ca3d5-ee05-40e2-a523-735cf2a19438", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28209", "type": "seen", "source": "https://t.me/cve0day/270", "content": "\ud83d\udea8 CVE-2026-28209\nFreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.\n\nhttps://github.com/FreePBX/security-reporting/security/advisories/GHSA-f558-mp87-58vj", "creation_timestamp": "2026-08-27T15:00:12.502456Z"}, {"uuid": "7d3ae7d9-7f49-4dc3-931a-178b5445fc7f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28302", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr6a2xgjpu2r", "content": "CVE-2026-28302 - serv-u\nServ-U, a file transfer server, has a security weakness that allows unauthorized access to sensitive areas. This can lead to an attacker gaining elevated privileges, potentially\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#servu #solarwinds #CVE #infosec", "creation_timestamp": "2026-07-21T16:28:04.873119Z"}, {"uuid": "59859a30-2c26-406e-b7da-4d4413404d88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28304", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr6a2yshpb2v", "content": "CVE-2026-28304 - serv-u\nA critical vulnerability in SolarWinds Serv-U on non-Windows systems allows attackers to execute malicious code with full system privileges. This could lead to unauthorized access,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#servu #solarwinds #CVE #infosec", "creation_timestamp": "2026-07-21T16:28:06.300913Z"}, {"uuid": "28dacba7-f7ff-4537-9383-9c2b90db5c5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28305", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr6a6k36ek2s", "content": "CVE-2026-28305 - serv-u\nServ-U, a Windows file transfer server, is at risk of a severe security breach if an attacker gains access to a privileged account. This could allow them to take control of the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#servu #solarwinds #CVE #infosec", "creation_timestamp": "2026-07-21T16:30:05.438830Z"}, {"uuid": "cf45a3de-1273-44c9-bf6b-5e80236ccf9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28306", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr6a6ldxen24", "content": "CVE-2026-28306 - serv-u\nServ-U, a file transfer server, has a security issue that allows a powerful Windows user to gain even more control. This could lead to unauthorized access to sensitive data or\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#servu #solarwinds #CVE #infosec", "creation_timestamp": "2026-07-21T16:30:06.793023Z"}, {"uuid": "1bdf1abc-25d4-49d1-8b4f-dd086000e647", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28307", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr6ac4jr2r2v", "content": "CVE-2026-28307 - serv-u\nA privilege escalation vulnerability in Serv-U could allow unauthorized users to gain administrator access. This could lead to data theft or system compromise if left unaddressed.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#servu #solarwinds #CVE #infosec", "creation_timestamp": "2026-07-21T16:32:05.125311Z"}, {"uuid": "fb9549db-d1dd-4eef-bcdb-4cd67d2cfc87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28308", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr6ac5ttqj2v", "content": "CVE-2026-28308 - serv-u\nServ-U, a file transfer server, has a security flaw that allows an attacker to execute malicious code on the system. This could happen if an attacker has domain administrator access.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#servu #solarwinds #CVE #infosec", "creation_timestamp": "2026-07-21T16:32:06.445087Z"}, {"uuid": "58852825-d7a7-4847-b86a-79b6de031816", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28309", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr6afo2iiy2z", "content": "CVE-2026-28309 - serv-u\nA security issue in SolarWinds Serv-U allows a domain administrator to create system administrator accounts, potentially giving them too much power. This is more of a concern in\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#servu #solarwinds #CVE #infosec", "creation_timestamp": "2026-07-21T16:34:04.009675Z"}, {"uuid": "21bcd1e8-1042-4151-afdf-76d83f143f63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28310", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr6afpcpwm2q", "content": "CVE-2026-28310 - serv-u\nServ-U, a file transfer server, has a security weakness that could allow a powerful Windows user to gain even more control. This is a concern because it could lead to unauthorized\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#servu #solarwinds #CVE #infosec", "creation_timestamp": "2026-07-21T16:34:05.245830Z"}, {"uuid": "f9d6b2d0-4e66-484d-8e42-4a05f47b18d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28312", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr6ajbif3b23", "content": "CVE-2026-28312 - serv-u\nServ-U, a SolarWinds software, has a security issue on Linux systems. If exploited, it could allow unauthorized users to gain administrator access and run malicious code. To stay\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#servu #solarwinds #CVE #infosec", "creation_timestamp": "2026-07-21T16:36:05.247318Z"}, {"uuid": "c30ef16c-442e-4063-b4b3-f275b5dc0779", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28313", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr6ajcpvl42q", "content": "CVE-2026-28313 - serv-u\nThe Serv-U email server software on Windows has a security flaw that allows hackers to take control of email accounts. This can happen if an attacker finds a way to access the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#servu #solarwinds #CVE #infosec", "creation_timestamp": "2026-07-21T16:36:06.387208Z"}, {"uuid": "52288447-8811-47f5-af7e-962db7b945e6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28314", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr6amsva4r23", "content": "CVE-2026-28314 - serv-u\nServ-U, a file transfer server, has a security issue that allows unauthorized access to accounts. This could lead to an attacker taking control of an account. If you use Serv-U,\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#servu #solarwinds #CVE #infosec", "creation_timestamp": "2026-07-21T16:38:04.185598Z"}, {"uuid": "c37f8e70-10c2-4819-b29c-280b2ac061e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28316", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr6amuchyj2a", "content": "CVE-2026-28316 - serv-u\nA vulnerability in SolarWinds Serv-U allows an attacker with an administrator account to gain system administrator privileges and potentially execute commands as the root user. This\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#servu #solarwinds #CVE #infosec", "creation_timestamp": "2026-07-21T16:38:05.314809Z"}, {"uuid": "67e7b697-d7e7-4387-9576-b7e845855b63", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28317", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr6aqfnokm2v", "content": "CVE-2026-28317 - serv-u\nAn attacker with domain administrator access can use this vulnerability to gain elevated privileges in SolarWinds Serv-U. This is a concern for organizations that rely on Serv-U for\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#servu #solarwinds #CVE #infosec", "creation_timestamp": "2026-07-21T16:40:04.516343Z"}, {"uuid": "03a8b7e3-0cff-4c39-9bb1-e97e3a9274aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28321", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mr6aqgvkrk2e", "content": "CVE-2026-28321 - serv-u\nA security issue in Serv-U on Linux systems allows an attacker with domain administrator access to read and write sensitive files, potentially leading to a complete takeover of the\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#servu #solarwinds #CVE #infosec", "creation_timestamp": "2026-07-21T16:40:05.526098Z"}, {"uuid": "5f9cc7ac-9b84-43c0-8c21-4fa66a4d5ccd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28317", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mr6byq6dsr2o", "content": "CVE-2026-28317 - Critical IDOR in SolarWinds Serv-U leads to privilege escalation. CVSS 9.1. Requires domain admin. Monitor for patch. #CVE #SolarWinds #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-28317/", "creation_timestamp": "2026-07-21T17:02:37.415029Z"}, {"uuid": "1b2d7356-353c-450f-b280-19a121ab55a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28307", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mr6d3cscwx2z", "content": "SolarWinds patched three critical Serv-U vulnerabilities (CVE-2026-28307/28308/28321). They allow privilege escalation and RCE. Update Serv-U to 2026.3.\n\n#SolarWinds #ServU #PrivilegeEscalation #RCE #IDOR #Cybersecurity #Vulnerability", "creation_timestamp": "2026-07-21T17:21:58.447485Z"}, {"uuid": "9b2e9d9f-a0f9-4bf6-9d8f-b3a8346a8737", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28740", "type": "published-proof-of-concept", "source": "https://github.com/go-gitea/gitea/security/advisories/GHSA-2m9v-5q2g-58vq", "content": "", "creation_timestamp": "2026-07-21T22:36:56.106000Z"}, {"uuid": "d35b40ca-243e-43e3-9a9c-a97be5e1332c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28516", "type": "seen", "source": "https://t.me/proxy_bar/3170", "content": "CVE-2026-28515, CVE-2026-28516, CVE-2026-28517\n*\nopenDCIM: From SQL Injection to RCE via Config Poisoning", "creation_timestamp": "2026-07-22T00:00:27.604726Z"}, {"uuid": "c0404943-b15d-423c-b46b-6d3c996223a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28515", "type": "seen", "source": "https://t.me/proxy_bar/3170", "content": "CVE-2026-28515, CVE-2026-28516, CVE-2026-28517\n*\nopenDCIM: From SQL Injection to RCE via Config Poisoning", "creation_timestamp": "2026-07-22T00:00:27.636036Z"}, {"uuid": "86866285-94de-4cd1-a0f7-c4df0121f167", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28517", "type": "seen", "source": "https://t.me/proxy_bar/3170", "content": "CVE-2026-28515, CVE-2026-28516, CVE-2026-28517\n*\nopenDCIM: From SQL Injection to RCE via Config Poisoning", "creation_timestamp": "2026-07-22T00:00:27.668643Z"}, {"uuid": "f63e63d4-8b40-4465-873f-c6160207a792", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28292", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/3201", "content": "CVE-2026-28292: RCE in simple-git\n\nFull Proof of Concept", "creation_timestamp": "2026-07-22T00:00:27.853653Z"}, {"uuid": "b3458e34-c2e8-47a9-b634-4cbdfc7df53a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/mCB2grCGFyDPyP46h0RoSTt2nzVg4a1r-qTUhzVOT_Pb_Nr6", "content": "", "creation_timestamp": "2026-08-25T00:00:21.972637Z"}, {"uuid": "6e25e559-246f-44f3-9dbf-0128c41a9bf1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/94zsc3RGfL-cYo-R392AxLlVEM1n1YwHAA5wklhiAnO4RRX-", "content": "", "creation_timestamp": "2026-08-25T00:00:22.203988Z"}, {"uuid": "d6a41940-016e-4b71-91cf-44533f64383b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/mVHbj7a1DYNF9kaBsr_OFLsg6Xhcx7FdBO2-7gQR_Jq3tWAA", "content": "", "creation_timestamp": "2026-08-25T00:00:11.816258Z"}, {"uuid": "0bdadcac-95a1-4451-b27b-18c9ea670e2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/1_b90yBOy2SfvjuZ69uWqxo4lLXWTFoL87sqOYfdotwyiTZa", "content": "", "creation_timestamp": "2026-08-25T00:00:21.485790Z"}, {"uuid": "221c3d0f-2c6a-4662-8eb2-f8a13301505a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/Wkw5Q93mgEWIMhhwt6CYg1p81IUQmroPxiysbO9zWQOWvyeP", "content": "", "creation_timestamp": "2026-08-25T00:00:21.726701Z"}, {"uuid": "3da17560-01b7-4b7c-98b6-b81e9fea3dbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28698", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrdxzjcpbs2j", "content": "CVE-2026-28698\nPronetiqs IntraVUE versions 3.2.1a14 and earlier allow unauthorized access to system files and data. This could lead to sensitive information being exposed, potentially compromising system security and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-23T23:20:05.012704Z"}, {"uuid": "6e556dbd-5b25-4c5a-9ca5-7d8ed61bec22", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28698", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mre2c2oeuo2w", "content": "\ud83d\udfe0 CVE-2026-28698 - High (8.6)\n\nPronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information t...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-28698/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-24T00:00:39.627023Z"}, {"uuid": "dbdd7ff5-6019-4f15-b0d2-4345623dee70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://t.me/ZerodayAlert/669", "content": "\u00ab\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0435\u00bb \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f iOS \u043f\u043e\u043c\u043e\u0433\u043b\u0438 \u0441\u043f\u0435\u0446\u0441\u043b\u0443\u0436\u0431\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0443 \u0432 Signal\n\n22 \u0430\u043f\u0440\u0435\u043b\u044f Apple \u0437\u0430\u043a\u0440\u044b\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-28950, \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8 \u0438 iPadOS 18.7.8. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f, \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f, \u043c\u043e\u0433\u043b\u0438 \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u043e \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\n\n\u041a\u043e\u043d\u0442\u0435\u043a\u0441\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0442\u0430\u043b \u043e\u0447\u0435\u0432\u0438\u0434\u043d\u0435\u0435 \u043f\u043e\u0441\u043b\u0435 \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u0433\u043e \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0438 \u0424\u0411\u0420 \u0438\u0437\u0432\u043b\u0435\u043a\u043b\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f Signal \u0441 iPhone \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u2014 \u043d\u0435 \u0438\u0437 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0430 \u0438\u0437 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0433\u043e \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0414\u0430\u043d\u043d\u044b\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u043b\u0438\u0441\u044c \u0434\u0430\u0436\u0435 \u043f\u043e\u0441\u043b\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u0441\u0430\u043c\u043e\u0433\u043e \u043c\u0435\u0441\u0441\u0435\u043d\u0434\u0436\u0435\u0440\u0430.\n\n\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u0438 Signal \u043f\u043e\u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u0438\u043b\u0438 Apple \u0437\u0430 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u043d\u0443\u0432, \u0447\u0442\u043e \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043b\u0438\u0447\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0438. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435, \u0430 \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 Signal \u2014 \u0441\u043a\u0440\u044b\u0442\u044c \u0442\u0435\u043a\u0441\u0442 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0432 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f\u0445 \u0438\u043b\u0438 \u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u043c\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044f.\n\n#apple #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #ios #\u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c\n\n@ZerodayAlert", "creation_timestamp": "2026-07-25T15:00:07.780626Z"}, {"uuid": "b6d7c594-c3e7-4eaf-b0ef-b9a4ee03310a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://t.me/ZerodayAlert/632", "content": "\u041e\u0434\u0438\u043d \u0441\u0438\u043c\u0432\u043e\u043b Unicode \u043e\u0431\u043e\u0448\u0451\u043b \u0437\u0430\u0449\u0438\u0442\u0443 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438\n\n\u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 FreeScout \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-28289 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 10). \u0414\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u043e \u0441 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u043d\u0430 \u043b\u044e\u0431\u043e\u0439 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u0439 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0430\u0434\u0440\u0435\u0441 \u2013 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0431\u0445\u043e\u0434\u043e\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0438\u043c\u0435\u043d\u0438 \u0444\u0430\u0439\u043b\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043d\u0435\u0432\u0438\u0434\u0438\u043c\u043e\u0433\u043e \u0441\u0438\u043c\u0432\u043e\u043b\u0430 Unicode U+200B \u2013 \u043f\u0440\u043e\u0431\u0435\u043b\u0430 \u043d\u0443\u043b\u0435\u0432\u043e\u0439 \u0448\u0438\u0440\u0438\u043d\u044b. \u0421\u0438\u0441\u0442\u0435\u043c\u0430 \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0442\u0430\u043a\u043e\u0439 \u0444\u0430\u0439\u043b \u043a\u0430\u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439, \u0430 \u0437\u0430\u0442\u0435\u043c \u0443\u0434\u0430\u043b\u044f\u0435\u0442 \u043d\u0435\u0432\u0438\u0434\u0438\u043c\u044b\u0439 \u0441\u0438\u043c\u0432\u043e\u043b \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442 \u0435\u0433\u043e \u0443\u0436\u0435 \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0441\u043a\u0440\u044b\u0442\u044b\u0439 \u0444\u0430\u0439\u043b.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 FreeScout 1.8.207 \u2013 \u0432\u0441\u0435 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438. \u0414\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 AllowOverrideAll \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 Apache \u0434\u043b\u044f \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u043e\u0432.\n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #freescout #unicode #zeroday \n\n@ZerodayAlert", "creation_timestamp": "2026-07-25T15:00:08.773909Z"}, {"uuid": "e8e4a7c5-95e0-4476-b633-5690f0633017", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28314", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrkwayrphp26", "content": "\ud83d\udccc CVE-2026-28314 - SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required.... https://www.cyberhub.blog/cves/CVE-2026-28314", "creation_timestamp": "2026-07-26T17:37:07.619948Z"}, {"uuid": "a9d27f94-d864-4354-9501-e59b83d856b8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://t.me/lobushkinflash/18578", "content": "Apple \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0432\u043d\u0435\u043f\u043b\u0430\u043d\u043e\u0432\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f iOS \u0438 iPadOS, \u0437\u0430\u043a\u0440\u044b\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-28950, \u0438\u0437-\u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f, \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435, \u043c\u043e\u0433\u043b\u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0421\u041c\u0418, \u0438\u043c\u0435\u043d\u043d\u043e \u0447\u0435\u0440\u0435\u0437 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u0424\u0411\u0420 \u0441\u043c\u043e\u0433\u043b\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f Signal \u0441 iPhone \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u0435\u043c\u043e\u0433\u043e, \u0434\u0430\u0436\u0435 \u043f\u043e\u0441\u043b\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. Signal \u043f\u043e\u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u0438\u043b Apple \u0437\u0430 \u0431\u044b\u0441\u0442\u0440\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u2014 Bleeping Computer\n\n#Signal #Apple #cybersecurity", "creation_timestamp": "2026-07-25T15:00:20.627123Z"}, {"uuid": "088ca88e-bac1-4838-b6bb-32954957634e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://t.me/ZerodayAlert/632", "content": "\u041e\u0434\u0438\u043d \u0441\u0438\u043c\u0432\u043e\u043b Unicode \u043e\u0431\u043e\u0448\u0451\u043b \u0437\u0430\u0449\u0438\u0442\u0443 \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438\n\n\u0412 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 FreeScout \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-28289 (\u043e\u0446\u0435\u043d\u043a\u0430 CVSS 10). \u0414\u043b\u044f \u0430\u0442\u0430\u043a\u0438 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u0438\u0441\u044c\u043c\u043e \u0441 \u0432\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c \u043d\u0430 \u043b\u044e\u0431\u043e\u0439 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u044b\u0439 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0430\u0434\u0440\u0435\u0441 \u2013 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0431\u0445\u043e\u0434\u043e\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0438\u043c\u0435\u043d\u0438 \u0444\u0430\u0439\u043b\u0430 \u043f\u0440\u0438 \u043f\u043e\u043c\u043e\u0449\u0438 \u043d\u0435\u0432\u0438\u0434\u0438\u043c\u043e\u0433\u043e \u0441\u0438\u043c\u0432\u043e\u043b\u0430 Unicode U+200B \u2013 \u043f\u0440\u043e\u0431\u0435\u043b\u0430 \u043d\u0443\u043b\u0435\u0432\u043e\u0439 \u0448\u0438\u0440\u0438\u043d\u044b. \u0421\u0438\u0441\u0442\u0435\u043c\u0430 \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0442\u0430\u043a\u043e\u0439 \u0444\u0430\u0439\u043b \u043a\u0430\u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439, \u0430 \u0437\u0430\u0442\u0435\u043c \u0443\u0434\u0430\u043b\u044f\u0435\u0442 \u043d\u0435\u0432\u0438\u0434\u0438\u043c\u044b\u0439 \u0441\u0438\u043c\u0432\u043e\u043b \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442 \u0435\u0433\u043e \u0443\u0436\u0435 \u043a\u0430\u043a \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0441\u043a\u0440\u044b\u0442\u044b\u0439 \u0444\u0430\u0439\u043b.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 FreeScout 1.8.207 \u2013 \u0432\u0441\u0435 \u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u043d\u043d\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u043c\u0438. \u0414\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 AllowOverrideAll \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 Apache \u0434\u043b\u044f \u0441\u043d\u0438\u0436\u0435\u043d\u0438\u044f \u0440\u0438\u0441\u043a\u043e\u0432.\n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #freescout #unicode #zeroday \n\n@ZerodayAlert", "creation_timestamp": "2026-07-26T00:00:35.211044Z"}, {"uuid": "eebe4f9b-c62d-401c-b3f4-b81ce45a21d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://t.me/ZerodayAlert/669", "content": "\u00ab\u0423\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0435\u00bb \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f iOS \u043f\u043e\u043c\u043e\u0433\u043b\u0438 \u0441\u043f\u0435\u0446\u0441\u043b\u0443\u0436\u0431\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0443 \u0432 Signal\n\n22 \u0430\u043f\u0440\u0435\u043b\u044f Apple \u0437\u0430\u043a\u0440\u044b\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-28950, \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f iOS 26.4.2, iPadOS 26.4.2, iOS 18.7.8 \u0438 iPadOS 18.7.8. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f, \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f, \u043c\u043e\u0433\u043b\u0438 \u043d\u0435\u043e\u0436\u0438\u0434\u0430\u043d\u043d\u043e \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u043d\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0435.\n\n\u041a\u043e\u043d\u0442\u0435\u043a\u0441\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0441\u0442\u0430\u043b \u043e\u0447\u0435\u0432\u0438\u0434\u043d\u0435\u0435 \u043f\u043e\u0441\u043b\u0435 \u043d\u0435\u0434\u0430\u0432\u043d\u0435\u0433\u043e \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0438 \u0424\u0411\u0420 \u0438\u0437\u0432\u043b\u0435\u043a\u043b\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f Signal \u0441 iPhone \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u2014 \u043d\u0435 \u0438\u0437 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0430 \u0438\u0437 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0433\u043e \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u0414\u0430\u043d\u043d\u044b\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u043b\u0438\u0441\u044c \u0434\u0430\u0436\u0435 \u043f\u043e\u0441\u043b\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u0441\u0430\u043c\u043e\u0433\u043e \u043c\u0435\u0441\u0441\u0435\u043d\u0434\u0436\u0435\u0440\u0430.\n\n\u041f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u0442\u0435\u043b\u0438 Signal \u043f\u043e\u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u0438\u043b\u0438 Apple \u0437\u0430 \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b, \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u043d\u0443\u0432, \u0447\u0442\u043e \u043f\u043e\u0434\u043e\u0431\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043b\u0438\u0447\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0438. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435, \u0430 \u0432 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u0445 Signal \u2014 \u0441\u043a\u0440\u044b\u0442\u044c \u0442\u0435\u043a\u0441\u0442 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439 \u0432 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f\u0445 \u0438\u043b\u0438 \u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u043c\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044f.\n\n#apple #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #ios #\u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c\n\n@ZerodayAlert", "creation_timestamp": "2026-07-26T00:00:36.912101Z"}, {"uuid": "e4baacd9-23c7-4bf4-a2a3-57f6e5ad48e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://t.me/lobushkinflash/18578", "content": "Apple \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0432\u043d\u0435\u043f\u043b\u0430\u043d\u043e\u0432\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f iOS \u0438 iPadOS, \u0437\u0430\u043a\u0440\u044b\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-28950, \u0438\u0437-\u0437\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f, \u043f\u043e\u043c\u0435\u0447\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435, \u043c\u043e\u0433\u043b\u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430. \u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c \u0421\u041c\u0418, \u0438\u043c\u0435\u043d\u043d\u043e \u0447\u0435\u0440\u0435\u0437 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0435 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u0424\u0411\u0420 \u0441\u043c\u043e\u0433\u043b\u043e \u0432\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f Signal \u0441 iPhone \u043f\u043e\u0434\u043e\u0437\u0440\u0435\u0432\u0430\u0435\u043c\u043e\u0433\u043e, \u0434\u0430\u0436\u0435 \u043f\u043e\u0441\u043b\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. Signal \u043f\u043e\u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u0438\u043b Apple \u0437\u0430 \u0431\u044b\u0441\u0442\u0440\u043e\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u2014 Bleeping Computer\n\n#Signal #Apple #cybersecurity", "creation_timestamp": "2026-07-26T00:00:44.822350Z"}, {"uuid": "d0a16888-9169-44a0-84c3-f0b418a10ea0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28284", "type": "seen", "source": "https://t.me/cyberwarehouse/1090", "content": "\ud83d\udea8 CVE-2026-28284\nFreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, the FreePBX logfiles module contains several authenticated SQL injection vulnerabilities. This issue has been patched in versions 16.0.10 and 17.0.5.\n\n\ud83c\udf96@cveNotify", "creation_timestamp": "2026-07-26T02:00:06.424305Z"}, {"uuid": "b9ba8d3e-d532-4899-a420-9938cea12dd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28304", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrkzmbga6l23", "content": "\ud83d\udccc CVE-2026-28304 - SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as roo... https://www.cyberhub.blog/cves/CVE-2026-28304", "creation_timestamp": "2026-07-26T18:37:06.662751Z"}, {"uuid": "d7e5adde-b985-4e3e-bc86-19b364ceaeb8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28305", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrl3bvzuid2y", "content": "\ud83d\udccc CVE-2026-28305 - SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain acc... https://www.cyberhub.blog/cves/CVE-2026-28305", "creation_timestamp": "2026-07-26T19:07:06.494574Z"}, {"uuid": "d8e00b07-6050-4599-acac-8f990743a108", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28306", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrl4xkp7un23", "content": "\ud83d\udccc CVE-2026-28306 - SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system admin... https://www.cyberhub.blog/cves/CVE-2026-28306", "creation_timestamp": "2026-07-26T19:37:06.336383Z"}, {"uuid": "f266eafb-2163-492e-8b08-b35e88d377cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28307", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrl6na36nh2v", "content": "\ud83d\udccc CVE-2026-28307 - SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The ... https://www.cyberhub.blog/cves/CVE-2026-28307", "creation_timestamp": "2026-07-26T20:07:07.276206Z"}, {"uuid": "7afc9687-876a-47b7-81fd-5bd4afbe0426", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28308", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrlacu7ll72l", "content": "\ud83d\udccc CVE-2026-28308 - SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator... https://www.cyberhub.blog/cves/CVE-2026-28308", "creation_timestamp": "2026-07-26T20:37:06.629055Z"}, {"uuid": "e7c7cab0-250c-4b25-b0f3-2ea8bd458308", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28849", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:45:39.887307Z"}, {"uuid": "3c03540d-c59d-4043-b7e3-0826cb07b9ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28896", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:45:42.248915Z"}, {"uuid": "9ceb4315-d80b-4d99-ba00-5b08c2230848", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28310", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrldo4thtn23", "content": "\ud83d\udccc CVE-2026-28310 - SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a syst... https://www.cyberhub.blog/cves/CVE-2026-28310", "creation_timestamp": "2026-07-26T21:37:06.324431Z"}, {"uuid": "3ad57372-a3a4-42bf-9ba6-db9e18f8bf98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28302", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrlfdry56g2y", "content": "\ud83d\udccc CVE-2026-28302 - SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execut... https://www.cyberhub.blog/cves/CVE-2026-28302", "creation_timestamp": "2026-07-26T22:07:06.609821Z"}, {"uuid": "12f5ce66-95be-41bc-b3d4-733dab7c3a61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28900", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:45:44.606357Z"}, {"uuid": "19804614-d103-4c66-a2e9-66a23e64310f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28911", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:45:46.970490Z"}, {"uuid": "e20c22d0-2dd1-4761-9f8a-ad4fa2edeb8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28912", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:45:49.431873Z"}, {"uuid": "23f9ed96-bd33-47a5-b5f7-77db6f6084ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28914", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:45:51.800304Z"}, {"uuid": "5d5a14ef-3fab-4d7a-9dd5-e676380f41ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28926", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:45:56.233905Z"}, {"uuid": "7bcd7822-5249-401b-b11c-b94cb44d2615", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28317", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrkpkgarej22", "content": "\ud83d\udccc CVE-2026-28317 - SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires d... https://www.cyberhub.blog/cves/CVE-2026-28317", "creation_timestamp": "2026-07-26T15:37:07.092425Z"}, {"uuid": "56fe1231-9a33-47b3-8b2b-734cec82b5ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28321", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrkra34xdm2u", "content": "\ud83d\udccc CVE-2026-28321 - SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escal... https://www.cyberhub.blog/cves/CVE-2026-28321", "creation_timestamp": "2026-07-26T16:07:07.833572Z"}, {"uuid": "a189b681-28db-4356-8deb-81741a5ff399", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28792", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17104", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, selected to avoid duplicates and previously shared entries.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-33321\n\ud83c\udfaf vBulletin \u2013 Remote Code Execution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/whitehatsk/CVE-2026-33321\n\n\ud83e\udde0 Overview\nA vulnerability in vBulletin allows attackers to execute arbitrary code via crafted requests targeting improperly validated input parameters.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Web forum compromise\n\u2022 Full server takeover\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-32014\n\ud83c\udfaf Liferay Portal \u2013 Authentication Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/ColdFusionX/CVE-2026-32014\n\n\ud83e\udde0 Overview\nA flaw in Liferay Portal allows attackers to bypass authentication and gain unauthorized access to restricted resources.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Privileged access\n\u2022 Enterprise portal compromise\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-30977\n\ud83c\udfaf PrestaShop \u2013 SQL Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/0xInfection/CVE-2026-30977\n\n\ud83e\udde0 Overview\nA SQL injection vulnerability in PrestaShop enables attackers to manipulate database queries through crafted input.\n\n\u2699\ufe0f Impact\n\u2022 Database compromise\n\u2022 Sensitive data exposure\n\u2022 Privilege escalation\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-29866\n\ud83c\udfaf Flask-Based Application \u2013 Template Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/d3vilbug/CVE-2026-29866\n\n\ud83e\udde0 Overview\nA server-side template injection vulnerability allows attackers to execute arbitrary code via unsanitized user input.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Application compromise\n\u2022 Data exposure\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-28792\n\ud83c\udfaf Magento \u2013 Arbitrary File Upload\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/blackhatsociety/CVE-2026-28792\n\n\ud83e\udde0 Overview\nA vulnerability in Magento allows attackers to upload malicious files, leading to remote code execution on the server.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Full system compromise\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Vulnerability research\n\u2022 Exploit development\n\u2022 Patch analysis\n\u2022 Red team / blue team exercises\n\n\u26a0\ufe0f Ethical Notice\nThis content is shared for cybersecurity research and defensive purposes only.\nDo not use this information for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:06.242481Z"}, {"uuid": "54918eff-4cba-488b-87ae-0c415c40a607", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28928", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:45:58.597999Z"}, {"uuid": "33baf335-d13d-43df-b8e8-cbbfc38e8b59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28931", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:46:00.969698Z"}, {"uuid": "df5ca315-c2d9-4ba5-81a6-b34abb5741b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28312", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrksvpexrs23", "content": "\ud83d\udccc CVE-2026-28312 - SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group\u2019s access to system administrator and allow code exec... https://www.cyberhub.blog/cves/CVE-2026-28312", "creation_timestamp": "2026-07-26T16:37:06.967565Z"}, {"uuid": "975eeb87-e8a0-46e6-a05b-5eef2f5abba1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28313", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrkuldwnwd2s", "content": "\ud83d\udccc CVE-2026-28313 - SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account... https://www.cyberhub.blog/cves/CVE-2026-28313", "creation_timestamp": "2026-07-26T17:07:06.449735Z"}, {"uuid": "cfae1def-f082-4b81-888f-1629cc3e784f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28932", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:46:03.333004Z"}, {"uuid": "2bce6b78-9ec3-4a82-abd9-2589ffe5c18a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28936", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:46:05.692151Z"}, {"uuid": "839bbdea-0dfb-4a3c-942f-28e74fb12b60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28945", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:46:08.059045Z"}, {"uuid": "e7e93d07-a46f-4c4d-b1c4-6468bf72782a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28961", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:46:10.651477Z"}, {"uuid": "f62a2d98-8603-4ebc-a389-999861c1d459", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28973", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:46:13.226269Z"}, {"uuid": "74f2dcad-cde4-49b0-bbe4-1a8a1618a0a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28979", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:46:15.812147Z"}, {"uuid": "92b162ef-63ee-49d4-8c87-c10739fd5f59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28981", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:46:18.190416Z"}, {"uuid": "a9acde02-80e3-4fbd-8d0d-462e8acc1feb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28983", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=1984", "content": "", "creation_timestamp": "2026-07-28T08:46:20.564407Z"}, {"uuid": "cd56bd9e-77c8-4e9b-adcd-0542f64f0be4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28284", "type": "seen", "source": "https://t.me/cyberwarehouse/1090", "content": "\ud83d\udea8 CVE-2026-28284\nFreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, the FreePBX logfiles module contains several authenticated SQL injection vulnerabilities. This issue has been patched in versions 16.0.10 and 17.0.5.\n\n\ud83c\udf96@cveNotify", "creation_timestamp": "2026-07-27T00:00:34.387265Z"}, {"uuid": "ef9a3c62-8f37-45f4-91d7-251c54ae5c4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28711", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17097", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are recent CVE vulnerabilities with publicly available Proof-of-Concept repositories on GitHub, selected to avoid duplicates and outdated entries.\n\n\u2796\u2796\u2796\u2796\n\n1\ufe0f\u20e3 CVE-2026-31452\n\ud83c\udfaf OpenCart \u2013 Arbitrary File Upload \u2192 RCE\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/exploitblizzard/CVE-2026-31452\n\n\ud83e\udde0 Overview\nA vulnerability in OpenCart allows attackers to upload arbitrary files without proper validation, leading to remote code execution on the server.\n\n\u2699\ufe0f Impact\n\u2022 Arbitrary file upload\n\u2022 Remote code execution\n\u2022 Full web server compromise\n\n\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-30121\n\ud83c\udfaf Zimbra Collaboration \u2013 Authentication Bypass\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/ry4n-h/CVE-2026-30121\n\n\ud83e\udde0 Overview\nA flaw in Zimbra allows attackers to bypass authentication mechanisms and gain unauthorized access to user accounts.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Account takeover\n\u2022 Email system compromise\n\n\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-28711\n\ud83c\udfaf Jenkins \u2013 Script Console Abuse\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/wh0amitz/CVE-2026-28711\n\n\ud83e\udde0 Overview\nA vulnerability in Jenkins enables attackers to execute arbitrary scripts through misconfigured or exposed script console endpoints.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 CI/CD pipeline compromise\n\u2022 Credential exposure\n\n\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-27654\n\ud83c\udfaf Drupal Module \u2013 SQL Injection\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/0xM4hmoud/CVE-2026-27654\n\n\ud83e\udde0 Overview\nA SQL injection vulnerability in a Drupal module allows attackers to manipulate database queries and extract sensitive data.\n\n\u2699\ufe0f Impact\n\u2022 Database compromise\n\u2022 Data leakage\n\u2022 Privilege escalation\n\n\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-26590\n\ud83c\udfaf Node.js Application \u2013 Prototype Pollution\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/s4vitar/CVE-2026-26590\n\n\ud83e\udde0 Overview\nA prototype pollution vulnerability allows attackers to modify application logic by injecting malicious object properties.\n\n\u2699\ufe0f Impact\n\u2022 Application logic manipulation\n\u2022 Potential RCE chain\n\u2022 Security control bypass\n\n\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\n\u2022 Exploit development\n\u2022 Patch analysis\n\u2022 Vulnerability chain study\n\u2022 Red / Blue Team training\n\n\u26a0\ufe0f Ethical Notice\nThis information is provided for cybersecurity research and defensive purposes only.\nDo not use it for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:06.589680Z"}, {"uuid": "91b0d28e-ab34-44a5-8a64-83749abd3433", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28931", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:46:15.117960Z"}, {"uuid": "e13b5c77-5889-4706-82d4-95a37b13ac96", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28932", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:46:17.498060Z"}, {"uuid": "e7990bf2-be65-4690-a4b4-634019d3bbf7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28936", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:46:20.104476Z"}, {"uuid": "6924122a-15eb-48ef-b81b-f4126e7c5e2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28945", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:46:22.486641Z"}, {"uuid": "c4168eac-6c6b-43e5-9981-310d8f9145c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28979", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:46:29.827740Z"}, {"uuid": "f4356cf4-b24d-46d9-8180-d020be29ea1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28981", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:46:32.200277Z"}, {"uuid": "d9abca6b-8598-4187-aa55-a260b652f7bf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28982", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:46:59.273047Z"}, {"uuid": "48b0994c-d4a2-4217-a563-ab4d65f4bd54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28983", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:47:01.661670Z"}, {"uuid": "64f5a1fb-a4f1-4480-b78f-8be92462568d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28961", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:46:24.869180Z"}, {"uuid": "aa8e8bb7-cd5f-4203-9ba2-8ad880b5325f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28973", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:46:27.442162Z"}, {"uuid": "ce54e1bd-0842-48ab-862b-9320cb2d1e27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28928", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:46:12.732167Z"}, {"uuid": "bec09d19-3f72-4d07-ab0c-40ba42e87f75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28849", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:45:55.861269Z"}, {"uuid": "ad03bf64-b732-40ec-8e3c-bd4cdae32621", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28911", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:46:02.997313Z"}, {"uuid": "cc748a40-1eb0-4f53-b025-c141d8d6091d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28896", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:45:58.241023Z"}, {"uuid": "cd41a2e1-3ac8-4ab4-bc54-54bc788b1e9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28900", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:46:00.626839Z"}, {"uuid": "a6911523-13b7-441b-81ea-bc5f41ad2254", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28912", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:46:05.584770Z"}, {"uuid": "d8da4f6e-263e-4b6b-8b34-f2362d3cb9dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28914", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:46:07.976417Z"}, {"uuid": "462b0d88-11eb-4ecc-87f2-1d5f29fed6ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28926", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260728", "content": "", "creation_timestamp": "2026-07-28T04:46:10.344506Z"}, {"uuid": "a114d54a-c1d3-430b-a7fc-1bbcca72363a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28516", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17007", "content": "\ud83d\udea8 openDCIM-Exploit \u2014 Vulnerabilities in openDCIM\n\n\ud83d\udd17GitHub:\nhttps://github.com/Chocapikk/opendcim-exploit\n\n\ud83d\udccc What Is This Repo?\nThis repository contains materials related to recent vulnerabilities in openDCIM, an open-source Data Center Infrastructure Management (DCIM) application.\nIt accompanies security research covering multiple linked vulnerabilities (authorization, SQL injection, OS command injection) affecting openDCIM version 23.04 and earlier.\n\nopenDCIM is a management platform often used to track power, network, rack resources, devices, and cabling for data centers.\n\n\ud83d\udee0 Vulnerabilities Covered\nThe exploit repository corresponds to three chained issues disclosed in early 2026:\n\n1\ufe0f\u20e3 CVE-2026-28515 \u2014 Missing Authorization\nA missing authorization check in install and upgrade handlers allows modification of configuration in openDCIM without proper privilege verification.\n\n2\ufe0f\u20e3 CVE-2026-28516 \u2014 SQL Injection\nThe Config::UpdateParameter function accepts unvalidated input in install scripts, leading to SQL injection against the database.\n\n3\ufe0f\u20e3 CVE-2026-28517 \u2014 OS Command Injection\nIn report_network_map.php, a database-controlled configuration parameter is passed directly to exec(), creating an OS command injection vulnerability.\nAll of these vulnerabilities are part of the same 23.04 commit chain and, when combined, raise the severity of impact significantly.\n\n\ud83e\udde0 Security Insight\nThese vulnerabilities highlight how improper access control, lack of input sanitization, and unsafe execution patterns in PHP applications can lead to critical outcomes:\n\u2022 Missing auth checks grant privileged interface access.\n\u2022 SQL injection through unsanitized config parameters undermines database integrity.\n\u2022 Direct command invocation through unsafe input allows OS command injection.\nThis demonstrates the importance of:\n\u2714\ufe0f Input validation and sanitization\n\u2714\ufe0f Strong authorization checks\n\u2714\ufe0f Proper coding practices around exec() and database operations\nfor secure web application development.\n\n\ud83d\udccc Why It\u2019s Relevant\nEven though openDCIM itself is a niche infrastructure tool, the patterns seen here are generalizable across web applications:\n\u2022 SQL injection and OS command injection are two of the most common and impactful vulnerability classes.\n\u2022 Misconfigured authentication and role enforcement open broad attack surface.\n\u2022 Chained bugs can elevate impact beyond each individual flaw.\nStudying these patterns deepens understanding of how complex vulnerabilities can be exploited in real environments.\n\n\u26a0\ufe0f Responsible Note\nThis repository and related exploit demonstrations are for research, education, and defensive study only.\nDo not run exploit code against systems you do not control or are not authorized to test. Unauthorized exploitation can be illegal and harmful.\nApplying vendor patches and validating secure coding practices is critical to mitigation.\n\n\ud83d\udce4 References for Further Context\n\u2022 CVE-2026-28515 Information (Missing Authorization)\n\u2022 CVE-2026-28516 SQL Injection Details\n\u2022 CVE-2026-28517 OS Command Injection Details\n\u2022 openDCIM project overview\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:10.167299Z"}, {"uuid": "45998c2b-c6ca-4036-8ec7-f436643654ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28515", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17007", "content": "\ud83d\udea8 openDCIM-Exploit \u2014 Vulnerabilities in openDCIM\n\n\ud83d\udd17GitHub:\nhttps://github.com/Chocapikk/opendcim-exploit\n\n\ud83d\udccc What Is This Repo?\nThis repository contains materials related to recent vulnerabilities in openDCIM, an open-source Data Center Infrastructure Management (DCIM) application.\nIt accompanies security research covering multiple linked vulnerabilities (authorization, SQL injection, OS command injection) affecting openDCIM version 23.04 and earlier.\n\nopenDCIM is a management platform often used to track power, network, rack resources, devices, and cabling for data centers.\n\n\ud83d\udee0 Vulnerabilities Covered\nThe exploit repository corresponds to three chained issues disclosed in early 2026:\n\n1\ufe0f\u20e3 CVE-2026-28515 \u2014 Missing Authorization\nA missing authorization check in install and upgrade handlers allows modification of configuration in openDCIM without proper privilege verification.\n\n2\ufe0f\u20e3 CVE-2026-28516 \u2014 SQL Injection\nThe Config::UpdateParameter function accepts unvalidated input in install scripts, leading to SQL injection against the database.\n\n3\ufe0f\u20e3 CVE-2026-28517 \u2014 OS Command Injection\nIn report_network_map.php, a database-controlled configuration parameter is passed directly to exec(), creating an OS command injection vulnerability.\nAll of these vulnerabilities are part of the same 23.04 commit chain and, when combined, raise the severity of impact significantly.\n\n\ud83e\udde0 Security Insight\nThese vulnerabilities highlight how improper access control, lack of input sanitization, and unsafe execution patterns in PHP applications can lead to critical outcomes:\n\u2022 Missing auth checks grant privileged interface access.\n\u2022 SQL injection through unsanitized config parameters undermines database integrity.\n\u2022 Direct command invocation through unsafe input allows OS command injection.\nThis demonstrates the importance of:\n\u2714\ufe0f Input validation and sanitization\n\u2714\ufe0f Strong authorization checks\n\u2714\ufe0f Proper coding practices around exec() and database operations\nfor secure web application development.\n\n\ud83d\udccc Why It\u2019s Relevant\nEven though openDCIM itself is a niche infrastructure tool, the patterns seen here are generalizable across web applications:\n\u2022 SQL injection and OS command injection are two of the most common and impactful vulnerability classes.\n\u2022 Misconfigured authentication and role enforcement open broad attack surface.\n\u2022 Chained bugs can elevate impact beyond each individual flaw.\nStudying these patterns deepens understanding of how complex vulnerabilities can be exploited in real environments.\n\n\u26a0\ufe0f Responsible Note\nThis repository and related exploit demonstrations are for research, education, and defensive study only.\nDo not run exploit code against systems you do not control or are not authorized to test. Unauthorized exploitation can be illegal and harmful.\nApplying vendor patches and validating secure coding practices is critical to mitigation.\n\n\ud83d\udce4 References for Further Context\n\u2022 CVE-2026-28515 Information (Missing Authorization)\n\u2022 CVE-2026-28516 SQL Injection Details\n\u2022 CVE-2026-28517 OS Command Injection Details\n\u2022 openDCIM project overview\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:10.219969Z"}, {"uuid": "26c59547-ce0f-4593-a145-6de2351e65d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28292", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17066", "content": "\u26a0\ufe0f CVE / ZERO-DAY\n\ud83d\udd25 New GitHub PoC CVE \u2013 Research Picks (Today / Fresh Only)\nBelow are fresh CVE PoC repositories actively updated or recently surfaced on GitHub, selected to avoid duplicates and outdated entries.\n\n1\ufe0f\u20e3 CVE-2026-20841\n\ud83c\udfaf Windows Notepad \u2013 Potential RCE (PoC)\n\n\ud83d\udd17 PoC Repository\nhttps://github.com/BTtea/CVE-2026-20841-PoC\n\n\ud83e\udde0 Overview\nA Proof-of-Concept targeting Windows Notepad (< 11.2510) demonstrates a possible remote code execution scenario through crafted input handling.\n\n\u2699\ufe0f Impact\n\u2022 Potential RCE vector\n\u2022 Local exploitation scenario\n\u2022 Early-stage PoC (research-focused)\n\n\u2796\u2796\u2796\u2796\u2796\n\n2\ufe0f\u20e3 CVE-2026-28292\n\ud83c\udfaf simple-git (Node.js) \u2013 Remote Code Execution\n\n\ud83e\udde0 Overview\nA critical vulnerability in the widely used simple-git library allows attackers to achieve remote code execution due to improper case-sensitive validation in security logic.\nA single missing regex flag allows bypass of previous security patches.\n\n\u2699\ufe0f Impact\n\u2022 Remote code execution\n\u2022 Patch bypass\n\u2022 Affects millions of installations\n\n\u2796\u2796\u2796\u2796\u2796\n\n3\ufe0f\u20e3 CVE-2026-29000\n\ud83c\udfaf pac4j-jwt \u2013 Authentication Bypass (CVSS 10)\n\n\ud83e\udde0 Overview\nA critical flaw in pac4j-jwt allows attackers to forge authentication tokens using only a public key, enabling full account takeover.\n\n\u2699\ufe0f Impact\n\u2022 Authentication bypass\n\u2022 Admin account takeover\n\u2022 CVSS 10.0 Critical\n\n\u2796\u2796\u2796\u2796\u2796\n\n4\ufe0f\u20e3 CVE-2026-21858\n\ud83c\udfaf n8n Workflow \u2013 Critical Vulnerability Detection / Exploit Path\n\n\ud83d\udd17 GitHub Topic\nhttps://github.com/topics/cve-2026-21858\n\n\ud83e\udde0 Overview\nA critical vulnerability affecting n8n workflow automation platforms, with tools and PoC-related detection scripts available on GitHub.\n\n\u2699\ufe0f Impact\n\u2022 Workflow compromise\n\u2022 Automation abuse\n\u2022 CVSS 10.0\n\n\u2796\u2796\u2796\u2796\u2796\n\n5\ufe0f\u20e3 CVE-2026-XXXX (Fresh Aggregated PoC Stream)\n\ud83c\udfaf Live GitHub PoC Feed (Auto-Collected CVEs)\n\n\ud83d\udd17 Repository\nhttps://github.com/nomi-sec/PoC-in-GitHub\n\n\ud83e\udde0 Overview\nThis repository continuously collects newly published CVE PoCs across GitHub, making it one of the most reliable sources for real-time vulnerability tracking.\n\n\u2699\ufe0f Impact\n\u2022 Continuous PoC discovery\n\u2022 Daily vulnerability tracking\n\u2022 Research automation source\n\n\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udcda Research Value\nThese entries are useful for:\n\u2022 Tracking real PoC release timing\n\u2022 Studying patch bypass techniques\n\u2022 Monitoring emerging exploit trends\n\u2022 Building automated CVE intelligence pipelines\n\n\u26a0\ufe0f Ethical Notice\nThis information is shared for cybersecurity research and defensive analysis only.\nDo not use vulnerability research for illegal activities.\n\n\ud83e\udde0 Cyber Security Exploit Research Community\nMalware Analysis | Reverse Engineering | CVE Research | Threat Intelligence\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:07.461755Z"}, {"uuid": "3b611e6d-f806-490d-9a0d-a69f2bb93417", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28755", "type": "seen", "source": "https://t.me/GithubRedTeam/95482", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a NGINX_2026_CVE_Bundle_CTI_Report\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ChPratik\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 07:35:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCovered CVEs: CVE-2026-28755, CVE-2026-42926, CVE-2026-9256, CVE-2026-42055, CVE-2026-42533\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-28T10:00:04.864456Z"}, {"uuid": "b00dccfd-3b23-48fe-b0a6-8bb57b05ec77", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28931", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrplq73j522v", "content": "CVE-2026-28931 - ios and ipados\nA security issue was fixed in recent updates to Apple's operating systems. This issue allowed a malicious server to potentially crash the system. To stay secure, ensure your devices are\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#apple #CVE #infosec", "creation_timestamp": "2026-07-28T14:12:04.326226Z"}, {"uuid": "702a330e-40d4-4194-8ef4-5c188f768574", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28911", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrpt7ticdh2q", "content": "CVE-2026-28911 - macos\nA malicious app can potentially corrupt the memory of a system process on macOS Sonoma and macOS Tahoe. This could lead to system instability or crashes. To mitigate the risk, update to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#macos #apple #CVE #infosec", "creation_timestamp": "2026-07-28T16:26:05.199384Z"}, {"uuid": "fba4b683-5999-4b12-8752-a8343d33fa29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28982", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrptkkrcki2r", "content": "CVE-2026-28982 - macos\nA bug in macOS allows a hacker to remotely shut down your system or damage its core memory. This affects macOS versions Sequoia, Sonoma, and Tahoe. You should update to the latest version\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#macos #apple #CVE #infosec", "creation_timestamp": "2026-07-28T16:32:05.298198Z"}, {"uuid": "5dfd7926-e2bd-44e7-875d-5e3cf89fc20c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28517", "type": "seen", "source": "https://t.me/CyberSecurityExploit/17007", "content": "\ud83d\udea8 openDCIM-Exploit \u2014 Vulnerabilities in openDCIM\n\n\ud83d\udd17GitHub:\nhttps://github.com/Chocapikk/opendcim-exploit\n\n\ud83d\udccc What Is This Repo?\nThis repository contains materials related to recent vulnerabilities in openDCIM, an open-source Data Center Infrastructure Management (DCIM) application.\nIt accompanies security research covering multiple linked vulnerabilities (authorization, SQL injection, OS command injection) affecting openDCIM version 23.04 and earlier.\n\nopenDCIM is a management platform often used to track power, network, rack resources, devices, and cabling for data centers.\n\n\ud83d\udee0 Vulnerabilities Covered\nThe exploit repository corresponds to three chained issues disclosed in early 2026:\n\n1\ufe0f\u20e3 CVE-2026-28515 \u2014 Missing Authorization\nA missing authorization check in install and upgrade handlers allows modification of configuration in openDCIM without proper privilege verification.\n\n2\ufe0f\u20e3 CVE-2026-28516 \u2014 SQL Injection\nThe Config::UpdateParameter function accepts unvalidated input in install scripts, leading to SQL injection against the database.\n\n3\ufe0f\u20e3 CVE-2026-28517 \u2014 OS Command Injection\nIn report_network_map.php, a database-controlled configuration parameter is passed directly to exec(), creating an OS command injection vulnerability.\nAll of these vulnerabilities are part of the same 23.04 commit chain and, when combined, raise the severity of impact significantly.\n\n\ud83e\udde0 Security Insight\nThese vulnerabilities highlight how improper access control, lack of input sanitization, and unsafe execution patterns in PHP applications can lead to critical outcomes:\n\u2022 Missing auth checks grant privileged interface access.\n\u2022 SQL injection through unsanitized config parameters undermines database integrity.\n\u2022 Direct command invocation through unsafe input allows OS command injection.\nThis demonstrates the importance of:\n\u2714\ufe0f Input validation and sanitization\n\u2714\ufe0f Strong authorization checks\n\u2714\ufe0f Proper coding practices around exec() and database operations\nfor secure web application development.\n\n\ud83d\udccc Why It\u2019s Relevant\nEven though openDCIM itself is a niche infrastructure tool, the patterns seen here are generalizable across web applications:\n\u2022 SQL injection and OS command injection are two of the most common and impactful vulnerability classes.\n\u2022 Misconfigured authentication and role enforcement open broad attack surface.\n\u2022 Chained bugs can elevate impact beyond each individual flaw.\nStudying these patterns deepens understanding of how complex vulnerabilities can be exploited in real environments.\n\n\u26a0\ufe0f Responsible Note\nThis repository and related exploit demonstrations are for research, education, and defensive study only.\nDo not run exploit code against systems you do not control or are not authorized to test. Unauthorized exploitation can be illegal and harmful.\nApplying vendor patches and validating secure coding practices is critical to mitigation.\n\n\ud83d\udce4 References for Further Context\n\u2022 CVE-2026-28515 Information (Missing Authorization)\n\u2022 CVE-2026-28516 SQL Injection Details\n\u2022 CVE-2026-28517 OS Command Injection Details\n\u2022 openDCIM project overview\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-27T20:00:10.323985Z"}, {"uuid": "118a0446-a0a8-4cfd-887d-614f6e446344", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28928", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T16:51:45.222161Z"}, {"uuid": "3ea01e59-72d9-4026-8a8a-c9752b61ce02", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28926", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T16:51:47.603432Z"}, {"uuid": "fa50f3e5-5a81-4ab9-a5d4-a931bff917e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28914", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T16:51:49.963623Z"}, {"uuid": "2edaf007-12cf-496e-b2b5-ac31ebe26db5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28912", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T16:51:52.539766Z"}, {"uuid": "c2417253-472b-4377-bb01-7c86f3bf2ae0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28911", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T16:51:55.100524Z"}, {"uuid": "1649a370-ec3b-4087-966d-62197a325f7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28900", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T16:51:57.474843Z"}, {"uuid": "6eaa3073-f7a6-485e-a917-9edc506fb9b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28896", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T16:51:59.859744Z"}, {"uuid": "d971fb43-d2be-4152-affc-6f8ebd6ba3c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28849", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T16:52:02.255923Z"}, {"uuid": "b8dae61c-9a6e-40bc-823d-49abffb8391d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28209", "type": "published-proof-of-concept", "source": "https://t.me/cve0day/270", "content": "\ud83d\udea8 CVE-2026-28209\nFreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.\n\nhttps://github.com/FreePBX/security-reporting/security/advisories/GHSA-f558-mp87-58vj", "creation_timestamp": "2026-08-29T00:00:30.265965Z"}, {"uuid": "6ec20a17-74ea-47c8-ae16-344937fdb6d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28931", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T17:15:02.663891Z"}, {"uuid": "55cff407-789d-4c0a-9508-4285b24efa54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28983", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T17:15:07.960997Z"}, {"uuid": "d853acf0-1a7b-4c7a-a46a-62ec94e78fc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28982", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T17:15:10.348249Z"}, {"uuid": "87f6df11-2e5d-4f11-b1f2-238f95f03eee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28981", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T17:15:12.725831Z"}, {"uuid": "10393516-8a52-48a0-9259-36761c2bc9d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28979", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T17:15:15.103736Z"}, {"uuid": "3b118b3e-4d0c-41da-b8a9-5cd17e36ebe8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28973", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T17:15:17.469113Z"}, {"uuid": "ddaa64e6-de33-4069-8c07-d62a0df6cf12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28961", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T17:15:19.840976Z"}, {"uuid": "6fda96a7-9109-4f57-be69-bf823dabce38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28945", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T17:15:24.341771Z"}, {"uuid": "53ce94c4-e63a-4874-8029-ca0b2bfc1e64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28936", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T17:15:27.311571Z"}, {"uuid": "e0e035b9-5c95-4e43-a816-78840dd56a72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28932", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-15", "content": "", "creation_timestamp": "2026-07-28T17:15:29.695341Z"}, {"uuid": "ebc28f98-eef5-49ce-b732-67e4e9e035dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28928", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrq7j7t6ra2u", "content": "CVE-2026-28928 - macos\nA security issue in Apple's operating systems allowed a malicious app to potentially crash the system. This has been fixed in the latest updates, so it's essential to update your devices\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#macos #apple #CVE #infosec", "creation_timestamp": "2026-07-28T20:06:04.838745Z"}, {"uuid": "420e65ce-e040-4013-a2a4-412603c5ab78", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28755", "type": "seen", "source": "https://t.me/GithubRedTeam/95482", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a NGINX_2026_CVE_Bundle_CTI_Report\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ChPratik\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-28 07:35:17\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCovered CVEs: CVE-2026-28755, CVE-2026-42926, CVE-2026-9256, CVE-2026-42055, CVE-2026-42533\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-29T00:00:39.220333Z"}, {"uuid": "ce2ff443-dc25-428f-9c5c-96d509802179", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28516", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17007", "content": "\ud83d\udea8 openDCIM-Exploit \u2014 Vulnerabilities in openDCIM\n\n\ud83d\udd17GitHub:\nhttps://github.com/Chocapikk/opendcim-exploit\n\n\ud83d\udccc What Is This Repo?\nThis repository contains materials related to recent vulnerabilities in openDCIM, an open-source Data Center Infrastructure Management (DCIM) application.\nIt accompanies security research covering multiple linked vulnerabilities (authorization, SQL injection, OS command injection) affecting openDCIM version 23.04 and earlier.\n\nopenDCIM is a management platform often used to track power, network, rack resources, devices, and cabling for data centers.\n\n\ud83d\udee0 Vulnerabilities Covered\nThe exploit repository corresponds to three chained issues disclosed in early 2026:\n\n1\ufe0f\u20e3 CVE-2026-28515 \u2014 Missing Authorization\nA missing authorization check in install and upgrade handlers allows modification of configuration in openDCIM without proper privilege verification.\n\n2\ufe0f\u20e3 CVE-2026-28516 \u2014 SQL Injection\nThe Config::UpdateParameter function accepts unvalidated input in install scripts, leading to SQL injection against the database.\n\n3\ufe0f\u20e3 CVE-2026-28517 \u2014 OS Command Injection\nIn report_network_map.php, a database-controlled configuration parameter is passed directly to exec(), creating an OS command injection vulnerability.\nAll of these vulnerabilities are part of the same 23.04 commit chain and, when combined, raise the severity of impact significantly.\n\n\ud83e\udde0 Security Insight\nThese vulnerabilities highlight how improper access control, lack of input sanitization, and unsafe execution patterns in PHP applications can lead to critical outcomes:\n\u2022 Missing auth checks grant privileged interface access.\n\u2022 SQL injection through unsanitized config parameters undermines database integrity.\n\u2022 Direct command invocation through unsafe input allows OS command injection.\nThis demonstrates the importance of:\n\u2714\ufe0f Input validation and sanitization\n\u2714\ufe0f Strong authorization checks\n\u2714\ufe0f Proper coding practices around exec() and database operations\nfor secure web application development.\n\n\ud83d\udccc Why It\u2019s Relevant\nEven though openDCIM itself is a niche infrastructure tool, the patterns seen here are generalizable across web applications:\n\u2022 SQL injection and OS command injection are two of the most common and impactful vulnerability classes.\n\u2022 Misconfigured authentication and role enforcement open broad attack surface.\n\u2022 Chained bugs can elevate impact beyond each individual flaw.\nStudying these patterns deepens understanding of how complex vulnerabilities can be exploited in real environments.\n\n\u26a0\ufe0f Responsible Note\nThis repository and related exploit demonstrations are for research, education, and defensive study only.\nDo not run exploit code against systems you do not control or are not authorized to test. Unauthorized exploitation can be illegal and harmful.\nApplying vendor patches and validating secure coding practices is critical to mitigation.\n\n\ud83d\udce4 References for Further Context\n\u2022 CVE-2026-28515 Information (Missing Authorization)\n\u2022 CVE-2026-28516 SQL Injection Details\n\u2022 CVE-2026-28517 OS Command Injection Details\n\u2022 openDCIM project overview\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:07.114568Z"}, {"uuid": "904bd7ee-a9fe-4652-8135-e514e26fd170", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28515", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17007", "content": "\ud83d\udea8 openDCIM-Exploit \u2014 Vulnerabilities in openDCIM\n\n\ud83d\udd17GitHub:\nhttps://github.com/Chocapikk/opendcim-exploit\n\n\ud83d\udccc What Is This Repo?\nThis repository contains materials related to recent vulnerabilities in openDCIM, an open-source Data Center Infrastructure Management (DCIM) application.\nIt accompanies security research covering multiple linked vulnerabilities (authorization, SQL injection, OS command injection) affecting openDCIM version 23.04 and earlier.\n\nopenDCIM is a management platform often used to track power, network, rack resources, devices, and cabling for data centers.\n\n\ud83d\udee0 Vulnerabilities Covered\nThe exploit repository corresponds to three chained issues disclosed in early 2026:\n\n1\ufe0f\u20e3 CVE-2026-28515 \u2014 Missing Authorization\nA missing authorization check in install and upgrade handlers allows modification of configuration in openDCIM without proper privilege verification.\n\n2\ufe0f\u20e3 CVE-2026-28516 \u2014 SQL Injection\nThe Config::UpdateParameter function accepts unvalidated input in install scripts, leading to SQL injection against the database.\n\n3\ufe0f\u20e3 CVE-2026-28517 \u2014 OS Command Injection\nIn report_network_map.php, a database-controlled configuration parameter is passed directly to exec(), creating an OS command injection vulnerability.\nAll of these vulnerabilities are part of the same 23.04 commit chain and, when combined, raise the severity of impact significantly.\n\n\ud83e\udde0 Security Insight\nThese vulnerabilities highlight how improper access control, lack of input sanitization, and unsafe execution patterns in PHP applications can lead to critical outcomes:\n\u2022 Missing auth checks grant privileged interface access.\n\u2022 SQL injection through unsanitized config parameters undermines database integrity.\n\u2022 Direct command invocation through unsafe input allows OS command injection.\nThis demonstrates the importance of:\n\u2714\ufe0f Input validation and sanitization\n\u2714\ufe0f Strong authorization checks\n\u2714\ufe0f Proper coding practices around exec() and database operations\nfor secure web application development.\n\n\ud83d\udccc Why It\u2019s Relevant\nEven though openDCIM itself is a niche infrastructure tool, the patterns seen here are generalizable across web applications:\n\u2022 SQL injection and OS command injection are two of the most common and impactful vulnerability classes.\n\u2022 Misconfigured authentication and role enforcement open broad attack surface.\n\u2022 Chained bugs can elevate impact beyond each individual flaw.\nStudying these patterns deepens understanding of how complex vulnerabilities can be exploited in real environments.\n\n\u26a0\ufe0f Responsible Note\nThis repository and related exploit demonstrations are for research, education, and defensive study only.\nDo not run exploit code against systems you do not control or are not authorized to test. Unauthorized exploitation can be illegal and harmful.\nApplying vendor patches and validating secure coding practices is critical to mitigation.\n\n\ud83d\udce4 References for Further Context\n\u2022 CVE-2026-28515 Information (Missing Authorization)\n\u2022 CVE-2026-28516 SQL Injection Details\n\u2022 CVE-2026-28517 OS Command Injection Details\n\u2022 openDCIM project overview\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:07.162908Z"}, {"uuid": "51d1d8b3-709c-45c4-a37b-55d21a91fc74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28151", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/hnqujzctqb3wg", "content": "CVE-2026-28151 - WordPress Tonda theme\nCVE ID : CVE-2026-28151\n \n Published : Aug. 24, 2026, 12:16 p.m. | 18\u00a0minutes ago\n \n Description : Unauthenticated Local File Inclusion in Tonda < 2.6 versions.\n \n Severity: 8.1 | HIGH\n \n Visit the link for more details, such as CVSS d...", "creation_timestamp": "2026-08-24T12:47:46.607542Z"}, {"uuid": "f6a413c8-01fb-4277-8caf-4da9d556ae49", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28517", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityExploit/17007", "content": "\ud83d\udea8 openDCIM-Exploit \u2014 Vulnerabilities in openDCIM\n\n\ud83d\udd17GitHub:\nhttps://github.com/Chocapikk/opendcim-exploit\n\n\ud83d\udccc What Is This Repo?\nThis repository contains materials related to recent vulnerabilities in openDCIM, an open-source Data Center Infrastructure Management (DCIM) application.\nIt accompanies security research covering multiple linked vulnerabilities (authorization, SQL injection, OS command injection) affecting openDCIM version 23.04 and earlier.\n\nopenDCIM is a management platform often used to track power, network, rack resources, devices, and cabling for data centers.\n\n\ud83d\udee0 Vulnerabilities Covered\nThe exploit repository corresponds to three chained issues disclosed in early 2026:\n\n1\ufe0f\u20e3 CVE-2026-28515 \u2014 Missing Authorization\nA missing authorization check in install and upgrade handlers allows modification of configuration in openDCIM without proper privilege verification.\n\n2\ufe0f\u20e3 CVE-2026-28516 \u2014 SQL Injection\nThe Config::UpdateParameter function accepts unvalidated input in install scripts, leading to SQL injection against the database.\n\n3\ufe0f\u20e3 CVE-2026-28517 \u2014 OS Command Injection\nIn report_network_map.php, a database-controlled configuration parameter is passed directly to exec(), creating an OS command injection vulnerability.\nAll of these vulnerabilities are part of the same 23.04 commit chain and, when combined, raise the severity of impact significantly.\n\n\ud83e\udde0 Security Insight\nThese vulnerabilities highlight how improper access control, lack of input sanitization, and unsafe execution patterns in PHP applications can lead to critical outcomes:\n\u2022 Missing auth checks grant privileged interface access.\n\u2022 SQL injection through unsanitized config parameters undermines database integrity.\n\u2022 Direct command invocation through unsafe input allows OS command injection.\nThis demonstrates the importance of:\n\u2714\ufe0f Input validation and sanitization\n\u2714\ufe0f Strong authorization checks\n\u2714\ufe0f Proper coding practices around exec() and database operations\nfor secure web application development.\n\n\ud83d\udccc Why It\u2019s Relevant\nEven though openDCIM itself is a niche infrastructure tool, the patterns seen here are generalizable across web applications:\n\u2022 SQL injection and OS command injection are two of the most common and impactful vulnerability classes.\n\u2022 Misconfigured authentication and role enforcement open broad attack surface.\n\u2022 Chained bugs can elevate impact beyond each individual flaw.\nStudying these patterns deepens understanding of how complex vulnerabilities can be exploited in real environments.\n\n\u26a0\ufe0f Responsible Note\nThis repository and related exploit demonstrations are for research, education, and defensive study only.\nDo not run exploit code against systems you do not control or are not authorized to test. Unauthorized exploitation can be illegal and harmful.\nApplying vendor patches and validating secure coding practices is critical to mitigation.\n\n\ud83d\udce4 References for Further Context\n\u2022 CVE-2026-28515 Information (Missing Authorization)\n\u2022 CVE-2026-28516 SQL Injection Details\n\u2022 CVE-2026-28517 OS Command Injection Details\n\u2022 openDCIM project overview\n\n\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\u2796\n\n\ud83d\udd10 Cyber Security Exploit Community\nTelegram Group\nhttps://t.me/Cyber_Security_Exploit\n\nTelegram Channel\nhttps://t.me/CyberSecurityExploit\n\nResearch \u2022 Ethical Hacking \u2022 Red Team", "creation_timestamp": "2026-08-28T00:00:07.052159Z"}, {"uuid": "bf6cdad6-c3b1-498f-a333-24f0451e376a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://t.me/CyberDispatch/919", "content": "New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical \u2014 high-severity, widely used software, or already drawing attention from the security community.\n\nCheck these first, patch what applies, and don't wait on the ones marked urgent \u2014 CVE-2026-2796 (Mozilla Firefox), CVE-2026-21385 (Qualcomm), CVE-2026-2256 (MS-Agent), CVE-2026-26198 (Ormar), CVE-2026-27966 (langflow), CVE-2025\u201364712 (Unstructured.io), CVE-2026-24009 (Docling), CVE-2026-23600 (HPE AutoPass License Server), CVE-2026-27636, CVE-2026-28289 (aka Mail2Shell) (FreeScout), CVE-2025-67736 (FreePBX), CVE-2025-34288 (Nagios XI), CVE-2025-14500 (IceWarp), CVE-2026-20079 (Cisco Secure Firewall Management Center), CVE-2025-13476 (Viber app for Android), CVE-2026-3336, CVE-2026-3337, CVE-2026-3338 (Amazon AWS-LC), CVE-2026-25611 (MongoDB), CVE-2026-3536, CVE-2026-3537, CVE-2026-3538 (Google Chrome), CVE-2026-27970 (Angular), CVE-2026-29058 (AVideo) a privilege escalation flaw in IPVanish VPN for macOS (no CVE), and and a remote code execution vulnerability in Ghost CMS (no CVE).", "creation_timestamp": "2026-08-29T20:00:20.573189Z"}, {"uuid": "b51c2152-8996-4206-b376-f64a1be3d707", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://t.me/CyberDispatch/919", "content": "New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical \u2014 high-severity, widely used software, or already drawing attention from the security community.\n\nCheck these first, patch what applies, and don't wait on the ones marked urgent \u2014 CVE-2026-2796 (Mozilla Firefox), CVE-2026-21385 (Qualcomm), CVE-2026-2256 (MS-Agent), CVE-2026-26198 (Ormar), CVE-2026-27966 (langflow), CVE-2025\u201364712 (Unstructured.io), CVE-2026-24009 (Docling), CVE-2026-23600 (HPE AutoPass License Server), CVE-2026-27636, CVE-2026-28289 (aka Mail2Shell) (FreeScout), CVE-2025-67736 (FreePBX), CVE-2025-34288 (Nagios XI), CVE-2025-14500 (IceWarp), CVE-2026-20079 (Cisco Secure Firewall Management Center), CVE-2025-13476 (Viber app for Android), CVE-2026-3336, CVE-2026-3337, CVE-2026-3338 (Amazon AWS-LC), CVE-2026-25611 (MongoDB), CVE-2026-3536, CVE-2026-3537, CVE-2026-3538 (Google Chrome), CVE-2026-27970 (Angular), CVE-2026-29058 (AVideo) a privilege escalation flaw in IPVanish VPN for macOS (no CVE), and and a remote code execution vulnerability in Ghost CMS (no CVE).", "creation_timestamp": "2026-08-30T00:00:45.552814Z"}, {"uuid": "00e70b6f-33e6-42fc-9a4c-f9c2364b5263", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://t.me/CyberDispatch/919", "content": "New vulnerabilities show up every week, and the window between disclosure and exploitation keeps getting shorter. The flaws below are this week's most critical \u2014 high-severity, widely used software, or already drawing attention from the security community.\n\nCheck these first, patch what applies, and don't wait on the ones marked urgent \u2014 CVE-2026-2796 (Mozilla Firefox), CVE-2026-21385 (Qualcomm), CVE-2026-2256 (MS-Agent), CVE-2026-26198 (Ormar), CVE-2026-27966 (langflow), CVE-2025\u201364712 (Unstructured.io), CVE-2026-24009 (Docling), CVE-2026-23600 (HPE AutoPass License Server), CVE-2026-27636, CVE-2026-28289 (aka Mail2Shell) (FreeScout), CVE-2025-67736 (FreePBX), CVE-2025-34288 (Nagios XI), CVE-2025-14500 (IceWarp), CVE-2026-20079 (Cisco Secure Firewall Management Center), CVE-2025-13476 (Viber app for Android), CVE-2026-3336, CVE-2026-3337, CVE-2026-3338 (Amazon AWS-LC), CVE-2026-25611 (MongoDB), CVE-2026-3536, CVE-2026-3537, CVE-2026-3538 (Google Chrome), CVE-2026-27970 (Angular), CVE-2026-29058 (AVideo) a privilege escalation flaw in IPVanish VPN for macOS (no CVE), and and a remote code execution vulnerability in Ghost CMS (no CVE).", "creation_timestamp": "2026-08-31T00:00:24.456737Z"}, {"uuid": "6d6e6e4f-9938-4b6a-b614-e4ffba28b0a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28867", "type": "published-proof-of-concept", "source": "Telegram/tcvPlgy4RT_-8DYuUczCHAOelno4AcU1hpFFn5ph0Pb3yXE", "content": "", "creation_timestamp": "2026-08-31T00:00:43.066183Z"}, {"uuid": "e0940214-1c09-49ea-8df1-6bcb79c46023", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://t.me/Russian_OSINT/7052", "content": "\ud83d\udcd6Apple \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u043e\u043b\u0438\u0446\u0438\u044f \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u043b\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0438\u0437 \u0447\u0430\u0442\u043e\u0432 \ud83d\udcf2 Signal \u043d\u0430 iPhone\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Apple \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (iOS 26.4.2), \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043f\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u043e\u0440\u0433\u0430\u043d\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u043c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c \u043d\u0430 iPhone \u0438 iPad. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u043b\u0430\u0441\u044c \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u043a\u044d\u0448\u0438\u0440\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 \u0431\u0430\u0437\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0441\u0440\u043e\u043a \u0434\u043e \u043e\u0434\u043d\u043e\u0433\u043e \u043c\u0435\u0441\u044f\u0446\u0430, \u043e\u0441\u0442\u0430\u0432\u0430\u044f\u0441\u044c \u0442\u0430\u043c \u0434\u0430\u0436\u0435 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0441\u0430\u043c\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u044b \u0438\u043b\u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0441\u0447\u0435\u0437\u043b\u0438 \u0432 \u0442\u0430\u043a\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u043a\u0430\u043a Signal \u0438\u043b\u0438 WhatsApp.\n\n\u041e\u0431 \u044d\u0442\u043e\u0439 \u043b\u0430\u0437\u0435\u0439\u043a\u0435 \u0441\u0442\u0430\u043b\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0438\u0437\u0434\u0430\u043d\u0438\u0435 404 Media \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u043e \u043e \u0441\u043b\u0443\u0447\u0430\u044f\u0445 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0424\u0411\u0420 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0438 Signal \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043a\u0440\u0438\u043c\u0438\u043d\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430. \u041f\u0440\u0435\u0437\u0438\u0434\u0435\u043d\u0442 Signal \u041c\u0435\u0440\u0435\u0434\u0438\u0442 \u0423\u0438\u0442\u0442\u0430\u043a\u0435\u0440 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u043f\u0440\u0438\u0437\u0432\u0430\u043b\u0430 Apple \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043e\u0448\u0438\u0431\u043a\u0443, \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u043d\u0443\u0432, \u0447\u0442\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u0445 \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u0432 \u0431\u0430\u0437\u0430\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u041e\u0421.\n\n\u0412 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Apple (CVE-2026-28950) \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u044b\u043b\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u043c \u0432\u0435\u0434\u0435\u043d\u0438\u0435\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432 \u0432 \u0441\u043b\u0443\u0436\u0431\u0430\u0445 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439, \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0435\u0451 \u043f\u0443\u0442\u0435\u043c \u0443\u043b\u0443\u0447\u0448\u0435\u043d\u0438\u044f \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445.\n\n*\u0414\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Meta (\u0432\u043b\u0430\u0434\u0435\u0435\u0442 Facebook, Instagram, WhatsApp) \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u0430 \u0432 \u0420\u0424 \u0438 \u043f\u0440\u0438\u0437\u043d\u0430\u043d\u0430 \ud83c\udff4\u200d\u2620\ufe0f\u044d\u043a\u0441\u0442\u0440\u0435\u043c\u0438\u0441\u0442\u0441\u043a\u043e\u0439.\n\n\u270b @Russian_OSINT", "creation_timestamp": "2026-09-02T06:00:19.454067Z"}, {"uuid": "e13cce2d-f9aa-42e1-b969-173e477e1870", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-2811", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/fdkyq6oplr7dl", "content": "CVE-2026-2811 - Ajaxify Comments\nCVE ID : CVE-2026-2811\n \n Published : Sept. 2, 2026, 2:25 p.m. | 50\u00a0minutes ago\n \n Description : The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping ...", "creation_timestamp": "2026-09-02T16:24:25.419486Z"}, {"uuid": "70cd691b-4629-4955-a19e-672f0b327537", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28950", "type": "seen", "source": "https://t.me/Russian_OSINT/7052", "content": "\ud83d\udcd6Apple \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043f\u043e\u043b\u0438\u0446\u0438\u044f \u0438\u0437\u0432\u043b\u0435\u043a\u0430\u043b\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0438\u0437 \u0447\u0430\u0442\u043e\u0432 \ud83d\udcf2 Signal \u043d\u0430 iPhone\n\n\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Apple \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (iOS 26.4.2), \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u044e\u0449\u0435\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b\u0430 \u043f\u0440\u0430\u0432\u043e\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u043e\u0440\u0433\u0430\u043d\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u043c \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u043c \u043d\u0430 iPhone \u0438 iPad. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u043b\u0430\u0441\u044c \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0435 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439 \u043a\u044d\u0448\u0438\u0440\u043e\u0432\u0430\u043b\u043e\u0441\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0439 \u0431\u0430\u0437\u0435 \u0434\u0430\u043d\u043d\u044b\u0445 \u043d\u0430 \u0441\u0440\u043e\u043a \u0434\u043e \u043e\u0434\u043d\u043e\u0433\u043e \u043c\u0435\u0441\u044f\u0446\u0430, \u043e\u0441\u0442\u0430\u0432\u0430\u044f\u0441\u044c \u0442\u0430\u043c \u0434\u0430\u0436\u0435 \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0441\u0430\u043c\u0438 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u044b \u0438\u043b\u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0438\u0441\u0447\u0435\u0437\u043b\u0438 \u0432 \u0442\u0430\u043a\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u043a\u0430\u043a Signal \u0438\u043b\u0438 WhatsApp.\n\n\u041e\u0431 \u044d\u0442\u043e\u0439 \u043b\u0430\u0437\u0435\u0439\u043a\u0435 \u0441\u0442\u0430\u043b\u043e \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u043e \u043f\u043e\u0441\u043b\u0435 \u0442\u043e\u0433\u043e, \u043a\u0430\u043a \u0438\u0437\u0434\u0430\u043d\u0438\u0435 404 Media \u0441\u043e\u043e\u0431\u0449\u0438\u043b\u043e \u043e \u0441\u043b\u0443\u0447\u0430\u044f\u0445 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e \u0438\u0437\u0432\u043b\u0435\u0447\u0435\u043d\u0438\u044f \u0424\u0411\u0420 \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u043a\u0438 Signal \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432 \u043a\u0440\u0438\u043c\u0438\u043d\u0430\u043b\u0438\u0441\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430. \u041f\u0440\u0435\u0437\u0438\u0434\u0435\u043d\u0442 Signal \u041c\u0435\u0440\u0435\u0434\u0438\u0442 \u0423\u0438\u0442\u0442\u0430\u043a\u0435\u0440 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e \u043f\u0440\u0438\u0437\u0432\u0430\u043b\u0430 Apple \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043e\u0448\u0438\u0431\u043a\u0443, \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u043d\u0443\u0432, \u0447\u0442\u043e \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u044f \u043e\u0431 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f\u0445 \u043d\u0435 \u0434\u043e\u043b\u0436\u043d\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0442\u044c\u0441\u044f \u0432 \u0431\u0430\u0437\u0430\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u041e\u0421.\n\n\u0412 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0438 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Apple (CVE-2026-28950) \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u044b\u043b\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043a\u043e\u0440\u0440\u0435\u043a\u0442\u043d\u044b\u043c \u0432\u0435\u0434\u0435\u043d\u0438\u0435\u043c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0436\u0443\u0440\u043d\u0430\u043b\u043e\u0432 \u0432 \u0441\u043b\u0443\u0436\u0431\u0430\u0445 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0439, \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0435\u0451 \u043f\u0443\u0442\u0435\u043c \u0443\u043b\u0443\u0447\u0448\u0435\u043d\u0438\u044f \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u043e\u0432 \u0440\u0435\u0434\u0430\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445.\n\n*\u0414\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Meta (\u0432\u043b\u0430\u0434\u0435\u0435\u0442 Facebook, Instagram, WhatsApp) \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u0430 \u0432 \u0420\u0424 \u0438 \u043f\u0440\u0438\u0437\u043d\u0430\u043d\u0430 \ud83c\udff4\u200d\u2620\ufe0f\u044d\u043a\u0441\u0442\u0440\u0435\u043c\u0438\u0441\u0442\u0441\u043a\u043e\u0439.\n\n\u270b @Russian_OSINT", "creation_timestamp": "2026-09-03T00:00:44.403120Z"}, {"uuid": "a3b60313-f85b-4552-912b-87686a2ef50b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/Ll1AzPD7QTzjWba10UNv1-Omd-fgpywQHDyh7DMj-s8cU8TfcA", "content": "", "creation_timestamp": "2026-09-03T08:00:04.910089Z"}, {"uuid": "c5881052-dc7e-4cbc-9592-9c585d23d507", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/Wq1RQ9DZ7N2QDdyjbZp2O4a0WnlHH9sKKPWozfdrK71FdlohDQ", "content": "", "creation_timestamp": "2026-09-03T08:00:05.075632Z"}, {"uuid": "d767089e-468a-4d9d-8b85-ccc513052b1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/dEu8f3Utvvz3CENWStBoW1q9DUH9bR4YUoyKQUPDbdvpHG7DHA", "content": "", "creation_timestamp": "2026-09-03T08:00:05.221262Z"}, {"uuid": "d069a0f5-520a-4813-8f44-d893a579cbbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/Wq1RQ9DZ7N2QDdyjbZp2O4a0WnlHH9sKKPWozfdrK71FdlohDQ", "content": "", "creation_timestamp": "2026-09-04T00:00:54.723021Z"}, {"uuid": "1f6e9314-d657-4224-897d-3b7065487444", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/Ll1AzPD7QTzjWba10UNv1-Omd-fgpywQHDyh7DMj-s8cU8TfcA", "content": "", "creation_timestamp": "2026-09-04T00:00:55.050570Z"}, {"uuid": "bd347471-1881-4a4a-b290-93afc921dd86", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/dEu8f3Utvvz3CENWStBoW1q9DUH9bR4YUoyKQUPDbdvpHG7DHA", "content": "", "creation_timestamp": "2026-09-04T00:00:55.340601Z"}, {"uuid": "97e2e348-ed36-4610-b2ff-a7b25399cab7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28323", "type": "seen", "source": "Telegram/bPFyihRaKzYFH468IH6VZ8obvtNAU0Sx5WI3sylwbu3LVzU", "content": "", "creation_timestamp": "2026-09-04T05:00:05.576010Z"}, {"uuid": "33142ae3-9d5f-4239-8d85-593eedd06e95", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/8yRqTs6iNIaG1p-0fIet7GRVNa1yJ-tacVkFZ69SKDvKdXX0xA", "content": "", "creation_timestamp": "2026-09-04T08:00:04.522684Z"}, {"uuid": "5a3cdfda-7489-49b3-a00a-f5d5e5fd34f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28192", "type": "seen", "source": "Telegram/8yRqTs6iNIaG1p-0fIet7GRVNa1yJ-tacVkFZ69SKDvKdXX0xA", "content": "", "creation_timestamp": "2026-09-05T01:00:34.899187Z"}, {"uuid": "048abe21-27f6-4271-9cd8-cdbd2c875b07", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28323", "type": "published-proof-of-concept", "source": "Telegram/bPFyihRaKzYFH468IH6VZ8obvtNAU0Sx5WI3sylwbu3LVzU", "content": "", "creation_timestamp": "2026-09-05T01:00:37.513673Z"}, {"uuid": "23a1e6f7-dd9e-4328-a699-94b462542ed9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28956", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101304", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-28956-jxl-messages-surface\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a eddinos2\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Objective-C\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-05 22:53:30\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nJPEG XL auto-decodes in the iOS Messages preview path \u2014 delivery-surface finding for CVE-2026-28956 (AppleJPEGXL), with patch-diff attribution (libjxl 0.10.4->0.10.5) and an honest reliability check on the public PoC.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-06T01:00:05.205228Z"}, {"uuid": "19cf51f2-44f6-4c5a-bc08-fad6d914c3c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28956", "type": "published-proof-of-concept", "source": "Telegram/0fB2wFx9rVMAPFy-F0wBOZ1Zwfkp3PdEKRrfYNzbjLXap34", "content": "", "creation_timestamp": "2026-09-06T12:00:06.464088Z"}, {"uuid": "61341f1e-7392-4f4b-9855-641174dd78d2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28956", "type": "published-proof-of-concept", "source": "Telegram/0fB2wFx9rVMAPFy-F0wBOZ1Zwfkp3PdEKRrfYNzbjLXap34", "content": "", "creation_timestamp": "2026-09-07T01:00:15.662284Z"}, {"uuid": "69542150-3460-4651-9bd3-0ddf6b95eb05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "Telegram/rgUS2xfP1LazmiWNfolsR27C0veXqG1jSYUwYlao_Y9G7E0", "content": "", "creation_timestamp": "2026-09-07T22:00:04.550559Z"}, {"uuid": "a2dd1280-e14b-4b6c-b602-b48872e9f063", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/rgUS2xfP1LazmiWNfolsR27C0veXqG1jSYUwYlao_Y9G7E0", "content": "", "creation_timestamp": "2026-09-08T00:00:09.955433Z"}, {"uuid": "2904146c-35f1-4981-a13f-a1c1e8397901", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28501", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/avideo_catname_sqli.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"arkmarta\", \"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"AVideo <= 22.0 is vulnerable to unauthenticated SQL injection via the\\n          catName parameter in objects/videos.json.php (CVE-2026-28501).\\n\\n          The security filter in security.php sanitizes GET/POST parameters but\\n          does not cover JSON request bodies. Since videos.json.php parses JSON\\n          input and merges it into $_REQUEST after the filter runs, a catName\\n          value sent as JSON bypasses sanitization entirely and reaches\\n          getCatSQL() unsanitized.\\n\\n          This module uses time-based blind injection with BENCHMARK() to dump\\n          usernames and password hashes. SLEEP() is blocked by the sqlDAL\\n          prepared statement layer, but BENCHMARK(N*(condition), SHA1(x)) works\\n          because the condition is evaluated as a multiplier on the iteration\\n          count, avoiding the subquery restrictions imposed by prepare().\\n\\n          Fixed in 24.0 (no 23.0 release exists).\", \"disclosure_date\": \"2026-03-05\", \"fullname\": \"auxiliary/gather/avideo_catname_sqli\", \"is_install_path\": true, \"mod_time\": \"2026-03-23 01:52:06 +0000\", \"name\": \"AVideo Unauthenticated SQL Injection Credential Dump\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/gather/avideo_catname_sqli.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"gather/avideo_catname_sqli\", \"references\": [\"CVE-2026-28501\", \"GHSA-pv87-r9qf-x56p\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:12.177706Z"}, {"uuid": "a328a288-b86b-4963-9067-d9ab8be33f43", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28516", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/opendcim_install_sqli_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a SQL injection vulnerability in openDCIM's install.php\\n          endpoint (CVE-2026-28515) to achieve remote code execution. The install.php\\n          script remains accessible after installation and processes LDAP configuration\\n          parameters via UpdateParameter() without authentication or input sanitization,\\n          allowing stacked SQL queries.\\n\\n          The exploit chain works by injecting SQL through the LDAP configuration form\\n          to overwrite the Graphviz dot binary path in fac_Config, then triggering\\n          report_network_map.php which calls exec() with the poisoned value. A backup\\n          of the original configuration is created before exploitation and restored\\n          after payload delivery.\\n\\n          Tested against openDCIM 23.04 through 25.01 on Ubuntu with Apache.\", \"disclosure_date\": \"2026-02-28\", \"fullname\": \"exploit/linux/http/opendcim_install_sqli_rce\", \"is_install_path\": true, \"mod_time\": \"2026-03-12 20:56:33 +0000\", \"name\": \"openDCIM install.php SQL Injection to RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/opendcim_install_sqli_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/opendcim_install_sqli_rce\", \"references\": [\"CVE-2026-28515\", \"CVE-2026-28516\", \"CVE-2026-28517\", \"URL-https://www.vulncheck.com/advisories/opendcim-missing-authorization-in-install-php\", \"URL-https://www.vulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter\", \"URL-https://www.vulncheck.com/advisories/opendcim-os-command-injection-via-dot-configuration-parameter\", \"URL-https://github.com/Chocapikk/opendcim-exploit\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Unix/Linux Command Shell\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:49.131688Z"}, {"uuid": "68250f79-3644-4664-8220-01c12ca75f65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28517", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/opendcim_install_sqli_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a SQL injection vulnerability in openDCIM's install.php\\n          endpoint (CVE-2026-28515) to achieve remote code execution. The install.php\\n          script remains accessible after installation and processes LDAP configuration\\n          parameters via UpdateParameter() without authentication or input sanitization,\\n          allowing stacked SQL queries.\\n\\n          The exploit chain works by injecting SQL through the LDAP configuration form\\n          to overwrite the Graphviz dot binary path in fac_Config, then triggering\\n          report_network_map.php which calls exec() with the poisoned value. A backup\\n          of the original configuration is created before exploitation and restored\\n          after payload delivery.\\n\\n          Tested against openDCIM 23.04 through 25.01 on Ubuntu with Apache.\", \"disclosure_date\": \"2026-02-28\", \"fullname\": \"exploit/linux/http/opendcim_install_sqli_rce\", \"is_install_path\": true, \"mod_time\": \"2026-03-12 20:56:33 +0000\", \"name\": \"openDCIM install.php SQL Injection to RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/opendcim_install_sqli_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/opendcim_install_sqli_rce\", \"references\": [\"CVE-2026-28515\", \"CVE-2026-28516\", \"CVE-2026-28517\", \"URL-https://www.vulncheck.com/advisories/opendcim-missing-authorization-in-install-php\", \"URL-https://www.vulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter\", \"URL-https://www.vulncheck.com/advisories/opendcim-os-command-injection-via-dot-configuration-parameter\", \"URL-https://github.com/Chocapikk/opendcim-exploit\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Unix/Linux Command Shell\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:49.208646Z"}, {"uuid": "314597fd-3a9c-4b33-9170-e579af97cbf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28515", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/opendcim_install_sqli_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a SQL injection vulnerability in openDCIM's install.php\\n          endpoint (CVE-2026-28515) to achieve remote code execution. The install.php\\n          script remains accessible after installation and processes LDAP configuration\\n          parameters via UpdateParameter() without authentication or input sanitization,\\n          allowing stacked SQL queries.\\n\\n          The exploit chain works by injecting SQL through the LDAP configuration form\\n          to overwrite the Graphviz dot binary path in fac_Config, then triggering\\n          report_network_map.php which calls exec() with the poisoned value. A backup\\n          of the original configuration is created before exploitation and restored\\n          after payload delivery.\\n\\n          Tested against openDCIM 23.04 through 25.01 on Ubuntu with Apache.\", \"disclosure_date\": \"2026-02-28\", \"fullname\": \"exploit/linux/http/opendcim_install_sqli_rce\", \"is_install_path\": true, \"mod_time\": \"2026-03-12 20:56:33 +0000\", \"name\": \"openDCIM install.php SQL Injection to RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/opendcim_install_sqli_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/opendcim_install_sqli_rce\", \"references\": [\"CVE-2026-28515\", \"CVE-2026-28516\", \"CVE-2026-28517\", \"URL-https://www.vulncheck.com/advisories/opendcim-missing-authorization-in-install-php\", \"URL-https://www.vulncheck.com/advisories/opendcim-sql-injection-in-config-updateparameter\", \"URL-https://www.vulncheck.com/advisories/opendcim-os-command-injection-via-dot-configuration-parameter\", \"URL-https://github.com/Chocapikk/opendcim-exploit\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Unix/Linux Command Shell\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:49.046954Z"}, {"uuid": "2288c115-2308-4d5a-b059-db436fbcf467", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28289", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/freescout_htaccess_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php, cmd, x86, x64\", \"author\": [\"offensiveee\", \"Nir Zadok (nirzadokox) \", \"Moses Bhardwaj (MosesOX) \", \"Valentin Lobstein \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443, 25, 465, 587, 2525, 25025, 25000], \"autofilter_services\": [\"http\", \"https\", \"smtp\", \"smtps\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an unauthenticated remote code execution vulnerability\\n          in FreeScout <= 1.8.206 (CVE-2026-28289). The sanitizeUploadedFileName()\\n          function checks for dot-prefixed filenames before stripping Unicode format\\n          characters (ZWSP U+200B), allowing .htaccess upload via email attachment.\\n\\n          A crafted email is sent via SMTP to a FreeScout mailbox. When fetched by\\n          the IMAP/POP3 cron (typically every 60s), the ZWSP is stripped and the\\n          attachment is stored as .htaccess. The file uses SetHandler to make itself\\n          executable as PHP, achieving code execution when requested via HTTP.\\n\\n          Requires a valid mailbox email address and web-accessible attachment\\n          storage (storage:link pointing to storage/app/).\", \"disclosure_date\": \"2026-03-01\", \"fullname\": \"exploit/multi/http/freescout_htaccess_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"FreeScout Unauthenticated RCE via ZWSP .htaccess Bypass\", \"needs_cleanup\": null, \"notes\": {\"AKA\": [\"Mail2Shell\"], \"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/freescout_htaccess_rce.rb\", \"platform\": \"Linux,PHP,Unix,Windows\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"multi/http/freescout_htaccess_rce\", \"references\": [\"CVE-2026-28289\", \"CVE-2026-27636\", \"GHSA-5gpc-65p8-ffwp\", \"GHSA-mw88-x7j3-74vc\", \"URL-https://www.ox.security/blog/freescout-rce-cve-2026-28289/\", \"URL-https://www.ox.security/blog/freescout-rce-cve-2026-27636/\"], \"rport\": 25, \"session_types\": false, \"targets\": [\"PHP In-Memory\", \"Unix/Linux Command Shell\", \"Linux Dropper\", \"Windows Command Shell\", \"Windows Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:47.389203Z"}, {"uuid": "452f3e95-84c0-4b88-9e78-403e41f648a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28609", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117236985026452664", "content": "The severity is increased for this new vulnerability affecting Google Android (CVE-2026-28609) https://vuldb.com/vuln/400204", "creation_timestamp": "2026-09-08T19:07:07.224993Z"}, {"uuid": "f0b7f2a2-1517-4ef8-8c01-e896737db7c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28618", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117237036872266123", "content": "The severity is increased for this new vulnerability affecting Google Android (CVE-2026-28618) https://vuldb.com/vuln/400224", "creation_timestamp": "2026-09-08T19:20:16.376517Z"}, {"uuid": "93e58ced-f206-4a2b-9b2e-8f0946f43cb3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28659", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/ivuqhemfno2ku", "content": "CVE-2026-28659 - MicroXR Blobstore Path Traversal Vulnerability\nCVE ID : CVE-2026-28659\n \n Published : Sept. 8, 2026, 7:20 p.m. | 11\u00a0minutes ago\n \n Description : In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This c...", "creation_timestamp": "2026-09-08T20:00:46.423795Z"}, {"uuid": "2ceb4ee4-ad19-4b05-b550-43704d874de2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28659", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mv223l3hyw2f", "content": "\ud83d\udea8 CVE-2026-28659 \u2014 CVSS 10 CRITICAL\n\nIn MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-28659\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-08T22:11:10.849122Z"}, {"uuid": "b3747d4f-00b1-4564-a2ff-d11276cd4302", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "https://t.me/androidMalware/2973", "content": "1-click could expose every contact saved on your Android, even if you never gave permission to access them (CVE-2026-28576)\nBlog: https://www.mobilehackinglab.com/blog/cve-2026-28576-contacts-provider-sqli\nDemo: https://www.youtube.com/shorts/nWzdx0uuULM\nPoC APK: https://github.com/mobilehackinglab/CVE-2026-28576-poc", "creation_timestamp": "2026-09-09T03:00:05.833833Z"}, {"uuid": "91f73395-bf7b-4725-9755-cc4e0fc8ac8d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28609", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:05.648572Z"}, {"uuid": "7a173c00-f7bc-4a19-80b3-a366b10aa8ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28572", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:45:27.661721Z"}, {"uuid": "a1f1ad8a-f8df-44fb-bfd2-71288eec1e72", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28581", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:45:29.969219Z"}, {"uuid": "6c8a0ab1-9da5-48a4-8638-95eb480af943", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28582", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:45:32.410235Z"}, {"uuid": "e70d3a2c-6113-4fba-977a-f95e2498b59a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28583", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:45:34.956747Z"}, {"uuid": "09f76f54-cf8f-4f25-ac4d-3d0d92d89039", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28584", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:45:37.175887Z"}, {"uuid": "4239260e-cb32-405b-85a4-a1dc235ca975", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28590", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:45:39.419630Z"}, {"uuid": "da5e2e76-4c83-42e0-887c-e8f1dc8de4a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28593", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:45:41.663249Z"}, {"uuid": "86dc1d1e-9992-4bbb-b99f-d258fb08fa39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28594", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:45:43.915858Z"}, {"uuid": "3142953a-c8a1-42ba-830d-4f982e571913", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28596", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:45:46.162434Z"}, {"uuid": "aa8786ac-c085-49b2-b10d-e38f97e4c787", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28599", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:45:48.390598Z"}, {"uuid": "5d1ffdc9-aab2-442b-85ea-5cd822795a7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28600", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:45:51.313742Z"}, {"uuid": "9fb243fa-75ac-4b1d-b81d-c427f35508ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28602", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:45:53.528693Z"}, {"uuid": "8d1c3f1e-37fd-46b0-91cd-fe517a6e8042", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28603", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:45:55.955006Z"}, {"uuid": "06f7279d-4191-455e-88b7-d66e3632d001", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28604", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:45:58.170516Z"}, {"uuid": "7da85db8-2dec-405f-8a45-528342989234", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28606", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:00.384385Z"}, {"uuid": "30725225-303d-49ae-911e-95b7f84a0a87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28607", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:03.440693Z"}, {"uuid": "12f1d412-2cc2-46b7-925a-399c48a8afa1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28611", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:07.953299Z"}, {"uuid": "e5e900d2-45b9-4b0b-a2fb-e6384cfb71f0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28612", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:10.211468Z"}, {"uuid": "a5c1660a-1f93-4ef8-a65f-bf238f80c0e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28617", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:19.568627Z"}, {"uuid": "a032768a-414d-4852-81d0-bd48e51f21be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28623", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:28.722079Z"}, {"uuid": "a51da9e9-71d2-4e92-a182-3e0ca9efd50f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28662", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:47:15.879729Z"}, {"uuid": "5540c609-d5f9-4753-81e3-a5adbb6762fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28613", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:12.620266Z"}, {"uuid": "94a7ca1b-7021-4564-82d3-d34beff2ce2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28642", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:53.680711Z"}, {"uuid": "3089dab7-f3d3-44f6-a669-d3f8d869fed6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28657", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:47:09.196148Z"}, {"uuid": "81edb3c4-4f16-4e00-8445-cebae602a327", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28614", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:15.068100Z"}, {"uuid": "f21d55ab-4f9b-4272-8c72-e8f0fc1e0dce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28631", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:40.084231Z"}, {"uuid": "d9731650-99b4-4979-86e9-d421a97befa4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28639", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:51.443090Z"}, {"uuid": "18c8330e-371b-4cc6-a667-9266f1364143", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28671", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:47:32.965599Z"}, {"uuid": "aceb97cf-75f0-40c9-89c2-c227a58ad60f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28616", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:17.330778Z"}, {"uuid": "dd675c2e-2ca5-40f6-b7ab-548fc0f521c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28622", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:26.275302Z"}, {"uuid": "364e7e04-f367-4533-90bd-697f1cae588b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28636", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:46.969157Z"}, {"uuid": "297f13bb-483d-4498-a10f-b5b2e49f594b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28618", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:21.799996Z"}, {"uuid": "4b0d4fd0-9174-4bd8-b365-36772098699a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28620", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:24.035672Z"}, {"uuid": "b55ec435-e41c-4f5e-9021-e0a876bf037d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28624", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:30.946698Z"}, {"uuid": "9d95a03d-d349-49a4-9029-8452e7f04501", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28626", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:33.184877Z"}, {"uuid": "a7077387-7480-41ae-af20-e658e7d020d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28627", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:35.417145Z"}, {"uuid": "be72bd66-2662-46e6-ba4c-3d290911a57f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28633", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:42.327724Z"}, {"uuid": "e1524d25-5233-483e-a1f3-eae65d26be89", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28655", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:47:04.782838Z"}, {"uuid": "ba1c7d98-863c-405e-8e9f-05da3b774ba5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28666", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:47:28.449737Z"}, {"uuid": "67c9d461-46fd-49b1-81ee-093ed88a951c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28630", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:37.652688Z"}, {"uuid": "041415ae-4db3-4a2c-ba76-ebb7887d201b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28634", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:44.744910Z"}, {"uuid": "9e5e5732-1f1f-4a2d-abfd-d7d606b2188b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28656", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:47:06.973866Z"}, {"uuid": "7d7d3fee-ee9a-4e60-a3b6-dcdc2a1ef1c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28638", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:49.160199Z"}, {"uuid": "fe567044-2700-4671-a5d3-5e8fbb01e935", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28644", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:55.880816Z"}, {"uuid": "0b9c01b8-a755-4dd5-95cf-77b552cd7bc6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28650", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:46:58.149539Z"}, {"uuid": "7a6fc1e8-5b9e-4c76-a3b5-3fdcea7af35f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28652", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:47:00.343275Z"}, {"uuid": "eec196dc-4435-4ee6-802f-e230184e3e2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28653", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:47:02.546980Z"}, {"uuid": "c1095de8-bf88-4ba5-92c8-ad0b7eb09981", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28660", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:47:13.649358Z"}, {"uuid": "4c5089fb-51ad-47b6-85ae-4c5fef4db017", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28658", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:47:11.426146Z"}, {"uuid": "8d7a30d3-8da7-45f4-b79c-ecfdae478e93", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28663", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:47:23.815372Z"}, {"uuid": "ce5d0047-bfe2-4ab8-b5ba-333483edb635", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28664", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:47:26.240498Z"}, {"uuid": "27d455bc-90fc-4ceb-a7c2-64a84ddacab8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28668", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities_20260909", "content": "", "creation_timestamp": "2026-09-09T04:47:30.677559Z"}, {"uuid": "fa04ddd8-7bb0-47e4-99e8-22cce3d118ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "https://t.me/GithubRedTeam/101496", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-28576-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mobilehackinglab\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-07 09:33:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSQL injection vulnerability in Android 17 (AOSP)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-09T05:00:06.951114Z"}, {"uuid": "925b0a41-6995-4f9a-97ad-d92a9e0514d0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "https://github.com/mobilehackinglab/CVE-2026-28576-poc", "content": "", "creation_timestamp": "2026-09-09T05:51:35.997444Z"}, {"uuid": "f74dcdfa-bf97-4c38-b465-97faeecfe09b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "https://source.android.com/docs/security/bulletin/android-17", "content": "", "creation_timestamp": "2026-09-09T05:52:31.658178Z"}, {"uuid": "2a4a6f4f-d888-4a3a-9242-a75065a56dd3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-28576", "type": "seen", "source": "https://bsky.app/profile/oxfemale.bsky.social/post/3mv3dzkujtw2m", "content": "Original text: \"SQL Injection Still Exists, Even in Android: One Picked Contact, Every Contact (CVE-2026-28576)\" \u2014 Mobile Hacking Lab. Code, tables and figures below are reproduced verbatim with attribution captions. #CVE #C\nhttps://core-jmp.org/2026/09/cve-2026-28576-android-sql-injection-contacts/", "creation_timestamp": "2026-09-09T10:41:40.931207Z"}, {"uuid": "fb749e2e-a388-43ac-9839-a2b1204a850a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28659", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv3hbxzahh2n", "content": "CVE-2026-28659 - android xr\nThe file storage component in MicroXR does not verify that an app is allowed to view a particular file, so one app can open files belonging to another app on the same device.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#androidxr #google #CVE #infosec", "creation_timestamp": "2026-09-09T11:40:04.168175Z"}, {"uuid": "226d2960-4da0-4bc3-a247-00fc85332220", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/101496", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-28576-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a mobilehackinglab\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Java\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-07 09:33:07\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nSQL injection vulnerability in Android 17 (AOSP)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-10T00:00:49.570738Z"}, {"uuid": "0681714f-27b1-4604-a251-5650b578c1fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "https://t.me/androidMalware/2973", "content": "1-click could expose every contact saved on your Android, even if you never gave permission to access them (CVE-2026-28576)\nBlog: https://www.mobilehackinglab.com/blog/cve-2026-28576-contacts-provider-sqli\nDemo: https://www.youtube.com/shorts/nWzdx0uuULM\nPoC APK: https://github.com/mobilehackinglab/CVE-2026-28576-poc", "creation_timestamp": "2026-09-10T00:00:55.052480Z"}, {"uuid": "cd1e29f7-a16a-4ad0-ab1d-3264585f51b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28606", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv6f63mg3q2f", "content": "CVE-2026-28606 - platform/packages/modules/bluetooth\nThe Bluetooth component in Android devices may incorrectly skip the normal pairing step, allowing a remote device to connect without the user's permission.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#google #Android #CVE #infosec", "creation_timestamp": "2026-09-10T15:40:05.083701Z"}, {"uuid": "3862d1d5-2328-402b-b15b-fff49487d39f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mv7bwwlgvi2o", "content": "CVE-2026-28576 (CVSS 10) is a SQL injection in the Android Contacts Provider. A public PoC dumps all contacts with no permissions. Patch Android 17 now.\n\n#CVE202628576 #Android #SQLInjection #Android17 #ContactsProvider #MobileSecurity #InfoSec #DataLeak #ExploitPoC #Pixel", "creation_timestamp": "2026-09-11T00:15:04.197509Z"}, {"uuid": "a77f8ac9-2564-48f6-b6d5-aec1c558d8a7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/OfGOp4Rfh5FVbd6rJEFp_owzyyxy2_rJbQkkQBNeIp8Ccng", "content": "", "creation_timestamp": "2026-09-13T00:00:36.893289Z"}, {"uuid": "d66082db-dedf-4f00-9a15-0ae2a51d3fc9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/VXIcnN_siwKUNgCV351_BdlDCQ8rrfKQD7gIMA8CWQ7l0e0", "content": "", "creation_timestamp": "2026-09-13T00:00:36.945733Z"}, {"uuid": "e19c8bcc-7f0c-407a-93e3-e4f58ff73d04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "Telegram/tqYq5d0gFZvNlDhc0sq77piMcsnfxb1OaZML_aOdQjE3ARk", "content": "", "creation_timestamp": "2026-09-12T14:00:03.420952Z"}, {"uuid": "6ac4f3c5-8569-4f59-8085-328ad4592657", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "Telegram/SgNwigLbNM_OsDdW5oOV8kt0sY8jgf31aX7HsmW-B9H7UKw", "content": "", "creation_timestamp": "2026-09-12T14:00:03.474227Z"}, {"uuid": "9e769112-66e1-4106-a4b6-1eb538665094", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/OfGOp4Rfh5FVbd6rJEFp_owzyyxy2_rJbQkkQBNeIp8Ccng", "content": "", "creation_timestamp": "2026-09-12T18:00:06.159511Z"}, {"uuid": "0380bca6-9448-48e4-8c05-72a6dab6d47c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/VXIcnN_siwKUNgCV351_BdlDCQ8rrfKQD7gIMA8CWQ7l0e0", "content": "", "creation_timestamp": "2026-09-12T18:00:06.205605Z"}, {"uuid": "52e2e624-9217-448c-984b-6a05806caef7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "Telegram/4S7jwSB0uirw-mqftu2JgPGIf-XUZcV1uIToVcVyJY7X2T4", "content": "", "creation_timestamp": "2026-09-12T22:00:04.703462Z"}, {"uuid": "aef11063-d128-4c15-b7a7-97edf06a2a65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "Telegram/RYyJvg3CfRpgqn78sblb4KepZewcArb7vzOfom2Iyd-EqS8", "content": "", "creation_timestamp": "2026-09-12T22:00:04.766863Z"}, {"uuid": "bab8baca-0cbf-4374-9753-3c3b35892957", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/RYyJvg3CfRpgqn78sblb4KepZewcArb7vzOfom2Iyd-EqS8", "content": "", "creation_timestamp": "2026-09-13T00:00:08.077768Z"}, {"uuid": "7235fe0f-363b-4c6d-ae12-30714d47cbbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/4S7jwSB0uirw-mqftu2JgPGIf-XUZcV1uIToVcVyJY7X2T4", "content": "", "creation_timestamp": "2026-09-13T00:00:08.146910Z"}, {"uuid": "06bce549-62ca-460b-b8b1-256fb212f2b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/SgNwigLbNM_OsDdW5oOV8kt0sY8jgf31aX7HsmW-B9H7UKw", "content": "", "creation_timestamp": "2026-09-13T00:00:41.381699Z"}, {"uuid": "b273ad39-0070-4560-a8f5-dfdcc2006fed", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/tqYq5d0gFZvNlDhc0sq77piMcsnfxb1OaZML_aOdQjE3ARk", "content": "", "creation_timestamp": "2026-09-13T00:00:41.430215Z"}, {"uuid": "6755fbd6-a682-4e36-99c4-2a3dfc443ef4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "Telegram/4EYRTkEdwVvNvO9mi6Dr4j1brpr2-_iMwbi2mhkhWapktD8", "content": "", "creation_timestamp": "2026-09-13T05:00:03.616328Z"}, {"uuid": "d54c7d8a-5b83-496f-9061-2d5aeda4c760", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "Telegram/6xsAEG_4wodm6bd-D5cYQvrsikYsyLjKv3TiQ9QbVpO7CYw", "content": "", "creation_timestamp": "2026-09-13T05:00:03.723133Z"}, {"uuid": "b010b86b-2032-45b3-9f7b-160cde90d770", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/6xsAEG_4wodm6bd-D5cYQvrsikYsyLjKv3TiQ9QbVpO7CYw", "content": "", "creation_timestamp": "2026-09-14T00:00:31.442195Z"}, {"uuid": "f967a5f7-2c61-41fa-8841-6872d2bcb549", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/4EYRTkEdwVvNvO9mi6Dr4j1brpr2-_iMwbi2mhkhWapktD8", "content": "", "creation_timestamp": "2026-09-14T00:00:31.544526Z"}, {"uuid": "1991c630-179e-4cbd-aaa8-44b7c4c82126", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28373", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3mvguwlgutb2h", "content": "Stackfield Desktop App: RCE via Path Traversal and Arbitrary File Write (CVE-2026-28373)", "creation_timestamp": "2026-09-14T00:43:31.027383Z"}, {"uuid": "4a1264a5-7972-414b-9786-7d3c2d0e21c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mvhdx7nbkn2o", "content": "Android Contacts SQL Injection Flaw CVE-2026-28576\uff08Android\u9023\u7d61\u5148\u306bSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u8106\u5f31\u6027\u3001\u60c5\u5831\u6f0f\u3048\u3044\u306e\u6050\u308c\uff09 #SecurityOnline \uff08Sep 11\uff09\n\nsecurityonline.info/cve-2026-285...", "creation_timestamp": "2026-09-14T05:12:18.294110Z"}, {"uuid": "2bdaba27-4ec1-4169-a108-bbcc83d21450", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/7WpCsvbEj-L_tF6hi_5C1cu8KuD8ZRW2hJ2kWfdJextMBLI", "content": "", "creation_timestamp": "2026-09-14T08:00:06.646754Z"}, {"uuid": "dc3645ad-f0ff-4fc6-b1a6-c499f9503720", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/HLjHIsDzz6ZpyPtkOHnkkPdqfgV3A7jk_lU1dgyTyc4ibj8", "content": "", "creation_timestamp": "2026-09-14T08:00:06.691080Z"}, {"uuid": "59e148c6-bb88-4627-aabd-af4852f9efd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/39OCtKroWLsN1GA4fcwDSdAc5Mq84iFipBhRhjbjBTmhSCg", "content": "", "creation_timestamp": "2026-09-14T15:00:04.876605Z"}, {"uuid": "62c4d4ce-7f89-42ec-aed1-53e2a062b33f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/5RJ7qfNeT1AArtkhgRA7Pf-8InbUGVVqP_Bgh1YnunaJyzk", "content": "", "creation_timestamp": "2026-09-14T15:00:04.936572Z"}, {"uuid": "9fbfe8ce-77bf-4f22-8c44-43aba0a7c87b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/nfvIXiDIsLkXGC6ohNG0vpBKwSrKME_WBvUCYKHLOzY3Njs", "content": "", "creation_timestamp": "2026-09-14T20:00:06.095750Z"}, {"uuid": "f518e20d-f3a0-4efc-983c-83d9803d54dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/VkcDNMj4O1k0XR03lKJDzGV_i0_zulOWkJcA4zQ0KvaHf7Y", "content": "", "creation_timestamp": "2026-09-14T20:00:06.124100Z"}, {"uuid": "fe17665e-7e99-4a99-934d-c0b1df2ce0c1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/39OCtKroWLsN1GA4fcwDSdAc5Mq84iFipBhRhjbjBTmhSCg", "content": "", "creation_timestamp": "2026-09-15T00:00:20.840714Z"}, {"uuid": "0e8779df-ff13-4e02-8160-92c678fa6f1c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/5RJ7qfNeT1AArtkhgRA7Pf-8InbUGVVqP_Bgh1YnunaJyzk", "content": "", "creation_timestamp": "2026-09-15T00:00:20.868740Z"}, {"uuid": "923418cb-316f-4a5b-859b-f45d2d25b8c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/nfvIXiDIsLkXGC6ohNG0vpBKwSrKME_WBvUCYKHLOzY3Njs", "content": "", "creation_timestamp": "2026-09-15T00:00:10.456865Z"}, {"uuid": "78e24e5e-8611-4b92-a9d4-931f4b36c716", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/VkcDNMj4O1k0XR03lKJDzGV_i0_zulOWkJcA4zQ0KvaHf7Y", "content": "", "creation_timestamp": "2026-09-15T00:00:10.478921Z"}, {"uuid": "f169f9b5-56fd-4af2-a5af-b057cc3c0e18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/7WpCsvbEj-L_tF6hi_5C1cu8KuD8ZRW2hJ2kWfdJextMBLI", "content": "", "creation_timestamp": "2026-09-15T00:00:26.860005Z"}, {"uuid": "184797ea-a868-4b1f-b980-9bfe1f92e956", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/HLjHIsDzz6ZpyPtkOHnkkPdqfgV3A7jk_lU1dgyTyc4ibj8", "content": "", "creation_timestamp": "2026-09-15T00:00:26.892377Z"}, {"uuid": "5470d8f7-1afc-45db-83b1-95de8634faa6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/2Gg2A-sIq6KrgOM9KBZay5dgMqtqwY0pEerN8pVSzCTaDEk", "content": "", "creation_timestamp": "2026-09-15T01:00:03.703502Z"}, {"uuid": "413a98ac-563f-478f-9b43-a9b274248588", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/fb6uk7QZKcPYdTr46H4FBioqUHtrk0GKO07sm94qBEDr0SY", "content": "", "creation_timestamp": "2026-09-15T01:00:03.733027Z"}, {"uuid": "21c59b42-a735-414c-b71f-97126344efa4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28659", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mvjngboq5m2e", "content": "\ud83d\udccc CVE-2026-28659 - In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of pr... https://www.cyberhub.blog/cves/CVE-2026-28659", "creation_timestamp": "2026-09-15T03:07:07.643773Z"}, {"uuid": "6f85956d-d581-4cad-8b05-c94c0b1c723c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28659", "type": "seen", "source": "https://bsky.app/profile/potato.software/post/3mvjngd2w2k2g", "content": "\ud83d\udccc CVE-2026-28659 - In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of pr... https://www.potatohub.blog/cves/CVE-2026-28659", "creation_timestamp": "2026-09-15T03:07:08.385778Z"}, {"uuid": "37c43bf3-705e-471b-ac26-9d96bf346a6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28899", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260915", "content": "", "creation_timestamp": "2026-09-15T04:45:12.120499Z"}, {"uuid": "ebf79183-4755-4121-bc67-bbce4d6512be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28966", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260915", "content": "", "creation_timestamp": "2026-09-15T04:45:21.700408Z"}, {"uuid": "18146a6b-4bc3-4cb3-b9a5-34241db8ba61", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28968", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260915", "content": "", "creation_timestamp": "2026-09-15T04:45:24.032873Z"}, {"uuid": "2e252ec8-4a71-4857-a208-2fc92e0c4f5d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28969", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260915", "content": "", "creation_timestamp": "2026-09-15T04:45:25.673696Z"}, {"uuid": "34a5fc7b-3e9b-41fc-bc86-66e6bc3c164d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28930", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260915", "content": "", "creation_timestamp": "2026-09-15T04:45:14.117447Z"}, {"uuid": "d87ffaf1-936e-48fd-ba2f-fcb6f64e7f64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28934", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260915", "content": "", "creation_timestamp": "2026-09-15T04:45:16.086861Z"}, {"uuid": "30a0dc2f-1cda-40f9-ae7a-5b2c8d5672a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28935", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260915", "content": "", "creation_timestamp": "2026-09-15T04:45:18.049165Z"}, {"uuid": "35313c64-750d-4a69-b7ba-6ca42b53cb68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28937", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/apple-products-multiple-vulnerabilities_20260915", "content": "", "creation_timestamp": "2026-09-15T04:45:19.682299Z"}, {"uuid": "e46318e5-d92b-477a-b290-3bc2b894e3cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/1pkvwgPDPhcqti5lgmPTWV1on8ZqV0J8ZlO-3gppFcCFyjs", "content": "", "creation_timestamp": "2026-09-15T07:00:05.699929Z"}, {"uuid": "80500a2b-d712-46a5-afbc-b9f73fccf23e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/FGci2Ez1RvHujGoCK6T_xb6tuZP6WzB4EorQ0QpOdz_Wotw", "content": "", "creation_timestamp": "2026-09-15T07:00:06.135309Z"}, {"uuid": "18d30862-e399-4c0f-ac8d-599f50c3ae62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "Telegram/KWMCk6Ihzen_C0AH2FIcgzkMFv6V_SKTW3nvqsqDDvfrqBc", "content": "", "creation_timestamp": "2026-09-15T14:00:05.712011Z"}, {"uuid": "9fdd5959-54fa-48a8-81bf-c91a548f1925", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "Telegram/t3imjZDCZUsVLhExbG0qBBsxeVPRGT1OggxoIbM46D6V2r0", "content": "", "creation_timestamp": "2026-09-15T14:00:05.764997Z"}, {"uuid": "cb68ed1c-0cbc-4a79-8611-3655ac77164d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "Telegram/_Noeb0WLMf1FjBz3t_5J1fWH1h50sXOXuC186AKyYqEcMV8", "content": "", "creation_timestamp": "2026-09-15T20:00:04.780993Z"}, {"uuid": "eb39fbca-2592-4896-b9e5-36096844908e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28966", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-19", "content": "", "creation_timestamp": "2026-09-15T20:47:19.968839Z"}, {"uuid": "bf45d62a-b66c-4ae7-9f21-61cd365a3e65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28930", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-19", "content": "", "creation_timestamp": "2026-09-15T20:47:04.483060Z"}, {"uuid": "739d21c5-9fe6-4686-b70e-f7203e665ede", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28899", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-19", "content": "", "creation_timestamp": "2026-09-15T20:47:12.379503Z"}, {"uuid": "ca89d639-baa2-4b43-a1c1-ff7d03d4c0de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28934", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-19", "content": "", "creation_timestamp": "2026-09-15T20:47:14.292529Z"}, {"uuid": "960b51d5-d3bc-42c1-a337-be69ec53f1a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28937", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-19", "content": "", "creation_timestamp": "2026-09-15T20:47:17.806000Z"}, {"uuid": "f4bdcb82-5d87-4b09-aa17-996afbcb72aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28969", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-19", "content": "", "creation_timestamp": "2026-09-15T20:47:02.554525Z"}, {"uuid": "08ebd22d-e78b-4dde-9470-e1b57499fd3e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28935", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-19", "content": "", "creation_timestamp": "2026-09-15T20:47:16.212691Z"}, {"uuid": "b3c5789b-16d1-418f-a884-88d5a8eb8c76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-28968", "type": "seen", "source": "https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-apple-19", "content": "", "creation_timestamp": "2026-09-15T20:47:21.934866Z"}, {"uuid": "e73b7349-62f4-4a1b-91ff-57f549b5b035", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "Telegram/oYe9WN5EckVm-yuxvAUvrAczIanSwOGSuB_EkJgSGCh8rqI", "content": "", "creation_timestamp": "2026-09-15T23:00:05.267405Z"}, {"uuid": "e937ffc3-1982-461f-911e-86d30c58a0b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "seen", "source": "Telegram/TJV8vGfDCQFYSHnnTU_V8Fbyxhg-TAWFMG-74Z3WS33iCv8", "content": "", "creation_timestamp": "2026-09-15T23:00:05.325634Z"}, {"uuid": "d63a6b9d-2e8d-44af-b118-3e55451fa071", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/TJV8vGfDCQFYSHnnTU_V8Fbyxhg-TAWFMG-74Z3WS33iCv8", "content": "", "creation_timestamp": "2026-09-16T00:00:08.793698Z"}, {"uuid": "6408d291-8d54-44c9-aa9f-622acbc4eff9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/oYe9WN5EckVm-yuxvAUvrAczIanSwOGSuB_EkJgSGCh8rqI", "content": "", "creation_timestamp": "2026-09-16T00:00:08.859211Z"}, {"uuid": "3d082062-845a-4b4b-8e91-371b8ad1d8d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/_Noeb0WLMf1FjBz3t_5J1fWH1h50sXOXuC186AKyYqEcMV8", "content": "", "creation_timestamp": "2026-09-16T00:00:11.863725Z"}, {"uuid": "dc1355d8-f363-47f3-bdc2-57e31e6239d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/1pkvwgPDPhcqti5lgmPTWV1on8ZqV0J8ZlO-3gppFcCFyjs", "content": "", "creation_timestamp": "2026-09-16T00:00:32.684398Z"}, {"uuid": "0b4f0769-3938-45c1-b65f-2a56a1ec1376", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/FGci2Ez1RvHujGoCK6T_xb6tuZP6WzB4EorQ0QpOdz_Wotw", "content": "", "creation_timestamp": "2026-09-16T00:00:33.296691Z"}, {"uuid": "3a213ffc-8a09-4c9b-9b08-6cb2c98cfca7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/t3imjZDCZUsVLhExbG0qBBsxeVPRGT1OggxoIbM46D6V2r0", "content": "", "creation_timestamp": "2026-09-16T00:00:30.908020Z"}, {"uuid": "5981264b-f02d-4a1b-8e5c-a287329ba1f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/KWMCk6Ihzen_C0AH2FIcgzkMFv6V_SKTW3nvqsqDDvfrqBc", "content": "", "creation_timestamp": "2026-09-16T00:00:30.961763Z"}, {"uuid": "1ec5a3df-32a0-40f6-98b4-6b927018c382", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/2Gg2A-sIq6KrgOM9KBZay5dgMqtqwY0pEerN8pVSzCTaDEk", "content": "", "creation_timestamp": "2026-09-16T00:00:34.223683Z"}, {"uuid": "75e30313-68db-4485-9cec-62c84ba06c67", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28576", "type": "published-proof-of-concept", "source": "Telegram/fb6uk7QZKcPYdTr46H4FBioqUHtrk0GKO07sm94qBEDr0SY", "content": "", "creation_timestamp": "2026-09-16T00:00:34.279428Z"}, {"uuid": "372db22f-36c4-488f-98e6-d21aeedf6262", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28937", "type": "seen", "source": "https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026", "content": "Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.\nFor the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn\u2019t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.\nCVE-2026-65400 \u2014 Screen Sharing Server (9.8 CRITICAL, \u26a0 CISA KEV).  This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.\nCVE-2026-65414 \u2014 Bluetooth (9.8 CRITICAL). This is the highest-scored non-exploited bug in the release. It\u2019s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it \"automatable: yes, technical impact: total.\" It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.\nCVE-2026-65346 \u2014 ImageIO (8.8 HIGH).  The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.\nTwo honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) \u2014 a sandbox-to-kernel arbitrary-code-execution bug \u2014 and CVE-2026-43790 (Kernel) \u2014 remote kernel memory corruption \u2014 are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\nApple Security Updates \u2014 September 14, 2026 (v27)\n\n\n    \n      273Total CVEs\n      134Scored\n      139TBD\n      2CRITICAL\n      46HIGH\n      84MEDIUM\n      2LOW\n    \n    \nCVSS is the NVD primary score where available, otherwise CISA-ADP secondary; TBD = NVD has not scored it yet (most v27 CVEs are still under analysis). \u26a0 KEV marks CVEs in CISA's Known Exploited Vulnerabilities catalog.\n    \n    \n\n      Apple security release — September 14, 2026 (version 27), 273 CVEs. CVSS/Severity from NVD (National Vulnerability Database) as of Sept 16, 2026. CVE IDs link to NVD. \"Yes/No\" indicates whether each update is affected.\n      \n          CVE IDComponentImpactCVSSSeverity\n          iOS / iPadOS 27\n          iOS / iPadOS 26.7\n          macOS 27 (Golden Gate)\n          macOS Tahoe 26.7\n          macOS Sequoia 15.8\n          tvOS 27\n          watchOS 27\n          visionOS 27\n          Safari 27\n          Xcode 27\n      \n      \n      \n        CVE-2026-65400\n        Screen Sharing Server\n        An attacker on the network may be able to authenticate to Screen Sharing without valid credentials\n        9.8\u26a0 KEV CRITICAL\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65414\n        Bluetooth\n        A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n        9.8CRITICAL\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43692\n        CUPS\n        A remote user may cause an unexpected app termination or arbitrary code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65346\n        ImageIO\n        Processing an image may lead to arbitrary code execution\n        8.8HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-43686\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        8.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65374\n        WebDAV\n        Connecting to a malicious WebDAV server may result in code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43794\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65390\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65391\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        8.6HIGH\n        NoNoNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84581\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        8.4HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84535\n        Automator\n        An app may be able to break out of its sandbox\n        8.2HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84516\n        CUPS\n        Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory\n        8.1HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65415\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        8.1HIGH\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84568\n        autofs\n        An attacker with control of a network directory server may be able to execute arbitrary code with root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84607\n        AVEVideoEncoder\n        A sandboxed app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84631\n        Bluetooth\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43786\n        CoreServices\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84575\n        CoreUI\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43691\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84505\n        Directory Utility\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65362\n        Disk Images\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        NoYesNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43684\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.8HIGH\n        NoYesYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43689\n        Kernel\n        A malicious app may be able to gain root privileges\n        7.8HIGH\n        YesYesYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86917\n        Kernel\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64712\n        odproxyd\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84515\n        SMB\n        Connecting to a malicious SMB server may lead to kernel memory corruption\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84506\n        udf\n        An app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64761\n        Accessibility\n        An app may be able to identify what other apps a user has installed\n        7.5HIGH\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86895\n        CloudKit\n        A local app may be able to read a persistent account identifier\n        7.5HIGH\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84563\n        CUPS\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84606\n        iCloud\n        An app may be able to identify a user across reinstalls\n        7.5HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        7.5HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28969\n        IOKit\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65343\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65364\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86894\n        libxpc\n        An app may be able to break out of its sandbox\n        7.5HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84543\n        SMB\n        Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84553\n        smbx\n        A remote attacker may be able to cause a denial-of-service\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28930\n        Spotlight\n        An app may be able to access protected user data\n        7.5HIGH\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-86904\n        Watch App\n        An app may be able to track users across apps and websites without permission\n        7.5HIGH\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-64752\n        CoreMedia\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        7.3HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84611\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84632\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64736\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.1HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-65349\n        Kernel\n        An app may be able to cause unexpected system termination or read kernel memory\n        6.6MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84537\n        SMB\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.6MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43788\n        Spotlight\n        Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n        6.6MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86882\n        Accelerate Framework\n        Processing a maliciously crafted image may lead to unexpected process termination\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84519\n        AppleDouble\n        Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n        6.5MEDIUM\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86879\n        Baseband\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86885\n        Baseband\n        An attacker in radio range may be able to cause unexpected system termination\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65412\n        CoreText\n        Processing web content may lead to a denial-of-service\n        6.5MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-84596\n        CoreText\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84597\n        FontParser\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2022-3437\n        Heimdal\n        A user in a privileged network position may be able to leak sensitive user information\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28934\n        HFS\n        Mounting a malicious disk image may cause unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65347\n        ImageIO\n        Processing an image may lead to a denial-of-service\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65395\n        ImageIO\n        Processing a maliciously crafted image may result in memory corruption\n        6.5MEDIUM\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43687\n        Kernel\n        Connecting to a malicious NFS server may disclose kernel memory\n        6.5MEDIUM\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-65330\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84538\n        Kernel\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84588\n        Kernel\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84487\n        SceneKit\n        Processing a maliciously crafted file may result in disclosure of process memory\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43719\n        SMB\n        Mounting a maliciously crafted SMB network share may lead to system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65365\n        SMB\n        Connecting to a malicious SMB share may disclose kernel memory\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84536\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43677\n        WebDAV\n        Connecting to a malicious WebDAV server may lead to unexpected app termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64715\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64753\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-64787\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64778\n        WebKit History\n        Visiting a maliciously crafted website may leak sensitive data\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84560\n        Bluetooth\n        An app may gain unauthorized access to Bluetooth\n        6.1MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84619\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        6.1MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84554\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.9MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43664\n        Accessibility\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-65404\n        Accounts\n        A malicious application may be able to bypass Privacy preferences\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84523\n        APFS\n        An app may be able to cause unexpected system termination or write kernel memory\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84586\n        Apple Account\n        A malicious application may be able to leak sensitive user information\n        5.5MEDIUM\n        NoNoYesNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65407\n        AppleAVD\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84593\n        AppleKeyStore\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        5.5MEDIUM\n        NoNoNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86905\n        Authentication Services\n        An app may be able to delete credentials stored in Keychain\n        5.5MEDIUM\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43737\n        CoreMotion\n        An app may be able to access motion data from headphones without user consent\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84489\n        CoreUI\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84534\n        file_cmds\n        Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-65409\n        Foundation\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64756\n        Image Capture\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        YesNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64760\n        IOSurfaceAccelerator\n        An app may be able to leak sensitive kernel state\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65401\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65402\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65405\n        Kernel\n        An app may be able to determine kernel memory layout\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84517\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84521\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-86903\n        Kernel\n        An app may be able to disclose kernel memory\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86883\n        Managed Configuration\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43741\n        Messages\n        An app may be able to access protected user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84491\n        Photos Storage\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84576\n        QuartzCore\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84555\n        Sandbox\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65413\n        SceneKit\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28937\n        Terminal\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        5.5MEDIUM\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65393\n        Xcode IDE\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoYes\n      \n      \n        CVE-2026-84617\n        XPC\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64788\n        IOGPUFamily\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-65341\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-34979\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.3MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86876\n        CoreMedia\n        A sandboxed process may be able to circumvent sandbox restrictions\n        5.2MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86889\n        Security\n        An attacker in a privileged network position may be able to intercept network traffic\n        4.8MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84492\n        Graphics\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84630\n        Kernel\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43690\n        SMB\n        A local user may be able to read kernel memory\n        4.7MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84518\n        Safari\n        A malicious website may be able to determine what apps a user has installed\n        4.3MEDIUM\n        YesNoYesNoNoNoNoNoYesNo\n      \n      \n        CVE-2026-43795\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64780\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64781\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64784\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65331\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65332\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65333\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65334\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65335\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65336\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65337\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65338\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65340\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65351\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64782\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64779\n        WebKit Storage\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86910\n        APFS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86888\n        App Store\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesNoYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84587\n        AppKit\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-20683\n        Apple Account\n        An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n        TBDTBD\n        YesNoYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84601\n        Apple Intelligence\n        An app may be able to bypass Apple Intelligence security prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65408\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84520\n        AppleFDEKeyStore\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65381\n        AppleMobileFileIntegrity\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84522\n        Archive Utility\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84584\n        Archive Utility\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65342\n        ATS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84525\n        ATS\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65339\n        Audio\n        An app may be able to leak sensitive user information\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84583\n        AuthKit\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84570\n        autofs\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65410\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84616\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65406\n        BackgroundAssets\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-86878\n        Camera\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84567\n        cd9660\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86893\n        CloudKit\n        An app may be able to read device name\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65399\n        copyfile\n        An archive may be able to bypass Gatekeeper\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86891\n        Core Bluetooth\n        An app may be able to access Bluetooth device information\n        TBDTBD\n        NoNoYesYesYesNoYesNoNoNo\n      \n      \n        CVE-2026-43683\n        CoreDrag\n        An app may be able to cause unexpected process termination or disclose process memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43789\n        CoreMedia\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65344\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43702\n        CoreMedia Video Toolbox\n        Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n        TBDTBD\n        NoYesNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84624\n        CoreML\n        A sandboxed app may be able to access restricted files\n        TBDTBD\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84559\n        CoreServices\n        A malicious application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84574\n        CoreServices\n        An app may be able to bypass Privacy preferences\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84511\n        CoreUI\n        Processing a maliciously crafted asset catalog may lead to unexpected process termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84571\n        CoreUI\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64790\n        CUPS\n        An app may be able to gain elevated privileges\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84540\n        CUPS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84541\n        CUPS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84612\n        DeviceCheck\n        An app may be able to read persistent device identifiers\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84512\n        Disk Images\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84550\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84552\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84565\n        Disk Images\n        Processing a maliciously crafted disk image may lead to unexpected app termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84510\n        exFAT\n        Mounting a maliciously crafted volume may lead to unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86900\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86901\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43785\n        File Bookmark\n        An app may be able to modify a file it only had permission to read\n        TBDTBD\n        YesNoYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43688\n        Filters\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84524\n        FontParser\n        Processing a maliciously crafted font file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84569\n        Foundation\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86911\n        Foundation\n        A malicious app may be able to bypass clickjacking protections for secure prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84618\n        Game Center\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84533\n        Heimdal\n        An attacker in a privileged network position may be able to modify network traffic\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-64714\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84564\n        ImageIO\n        Processing a maliciously crafted image may result in disclosure of process memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86869\n        ImageIO\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        NoYesYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoYesNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65398\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65354\n        iWork\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28935\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-28968\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43790\n        Kernel\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65358\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65359\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65360\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65369\n        Kernel\n        A malicious application may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65371\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65377\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84507\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84530\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84544\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84549\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84558\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84561\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84566\n        Kernel\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84602\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84622\n        Kernel\n        An app with root privileges may be able to read uninitialized kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84514\n        Kext Management\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84556\n        Keychain Access\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65382\n        LaunchServices\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86870\n        libarchive\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84577\n        libxpc\n        An app may be able to bypass sandbox restrictions\n        TBDTBD\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43787\n        Mail\n        An attacker in a privileged network position may be able to leak sensitive user information\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84573\n        Mail\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84628\n        MediaRemote\n        A sandboxed app may be able to access the System Keychain\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86924\n        MobileAccessoryUpdater\n        Connecting a malicious accessory may cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65411\n        MobileBackup\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84598\n        MobileBackup\n        An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84497\n        Model I/O\n        Opening a maliciously crafted file may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84615\n        Music\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesNoNoNoYesNoYesNoNo\n      \n      \n        CVE-2026-43695\n        NetworkExtension\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84585\n        NetworkExtension\n        An app may be able to access local network devices without user consent\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84626\n        NetworkExtension\n        An app may be able to identify what other apps a user has installed\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86902\n        NSDocument\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84629\n        Photos Storage\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84623\n        Power Management\n        An app may be able to fingerprint the device\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84578\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84580\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84548\n        Quick Look\n        Processing a maliciously crafted document may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28966\n        RealityKit\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84532\n        RealityKit\n        Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-65403\n        Reminders\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86897\n        Safe Browsing\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65380\n        Sandbox\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84551\n        Sandbox\n        An app may be able to bypass network restrictions\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84603\n        Sandbox Profiles\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84625\n        Sandbox Profiles\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43697\n        SceneKit\n        Processing a maliciously crafted 3D file may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84526\n        SceneKit\n        Processing a maliciously crafted 3D scene may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84546\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84620\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84531\n        Security\n        Processing maliciously crafted NTLM input may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86881\n        Security\n        An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84600\n        Shortcuts\n        A malicious shortcut may be able to send messages without user confirmation\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86884\n        Siri\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-86890\n        Siri Suggestions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65376\n        SMB\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84509\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84609\n        Software Update\n        An app may be able to modify protected system files\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65361\n        SoftwareUpdate\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65378\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84621\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86892\n        SpringBoard\n        An app may be able to cause a denial-of-service\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65345\n        Storage\n        An app may be able to access user-sensitive data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65348\n        Storage\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43791\n        StorageKit\n        An app may be able to read arbitrary files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84513\n        Symptom Framework\n        A malicious application may be able to determine a user's current location\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65383\n        System Settings\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86909\n        System Settings\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84527\n        TCC\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84589\n        TCC\n        An app may be able to modify Privacy preferences\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86886\n        TCC\n        An app may be able to modify protected system files\n        TBDTBD\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65329\n        Telephony\n        An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86887\n        Time Zone\n        An app may be able to bypass certain Privacy preferences\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43696\n        Touch Bar\n        An app may be able to capture Touch Bar content without authorization\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84572\n        udf\n        An app may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28899\n        WebDAV\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65375\n        WebDAV\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-84635\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-86898\n        WebKit\n        Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n        TBDTBD\n        YesNoYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-84636\n        Wi-Fi Connectivity\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43674\n        Wi-Fi3\n        An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n    \n    \n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-09-16T22:01:10.705836Z"}, {"uuid": "c6bfebe5-8900-40b2-9e2d-f53371f2f642", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28969", "type": "seen", "source": "https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026", "content": "Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.\nFor the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn\u2019t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.\nCVE-2026-65400 \u2014 Screen Sharing Server (9.8 CRITICAL, \u26a0 CISA KEV).  This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.\nCVE-2026-65414 \u2014 Bluetooth (9.8 CRITICAL). This is the highest-scored non-exploited bug in the release. It\u2019s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it \"automatable: yes, technical impact: total.\" It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.\nCVE-2026-65346 \u2014 ImageIO (8.8 HIGH).  The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.\nTwo honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) \u2014 a sandbox-to-kernel arbitrary-code-execution bug \u2014 and CVE-2026-43790 (Kernel) \u2014 remote kernel memory corruption \u2014 are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\nApple Security Updates \u2014 September 14, 2026 (v27)\n\n\n    \n      273Total CVEs\n      134Scored\n      139TBD\n      2CRITICAL\n      46HIGH\n      84MEDIUM\n      2LOW\n    \n    \nCVSS is the NVD primary score where available, otherwise CISA-ADP secondary; TBD = NVD has not scored it yet (most v27 CVEs are still under analysis). \u26a0 KEV marks CVEs in CISA's Known Exploited Vulnerabilities catalog.\n    \n    \n\n      Apple security release — September 14, 2026 (version 27), 273 CVEs. CVSS/Severity from NVD (National Vulnerability Database) as of Sept 16, 2026. CVE IDs link to NVD. \"Yes/No\" indicates whether each update is affected.\n      \n          CVE IDComponentImpactCVSSSeverity\n          iOS / iPadOS 27\n          iOS / iPadOS 26.7\n          macOS 27 (Golden Gate)\n          macOS Tahoe 26.7\n          macOS Sequoia 15.8\n          tvOS 27\n          watchOS 27\n          visionOS 27\n          Safari 27\n          Xcode 27\n      \n      \n      \n        CVE-2026-65400\n        Screen Sharing Server\n        An attacker on the network may be able to authenticate to Screen Sharing without valid credentials\n        9.8\u26a0 KEV CRITICAL\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65414\n        Bluetooth\n        A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n        9.8CRITICAL\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43692\n        CUPS\n        A remote user may cause an unexpected app termination or arbitrary code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65346\n        ImageIO\n        Processing an image may lead to arbitrary code execution\n        8.8HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-43686\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        8.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65374\n        WebDAV\n        Connecting to a malicious WebDAV server may result in code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43794\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65390\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65391\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        8.6HIGH\n        NoNoNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84581\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        8.4HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84535\n        Automator\n        An app may be able to break out of its sandbox\n        8.2HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84516\n        CUPS\n        Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory\n        8.1HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65415\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        8.1HIGH\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84568\n        autofs\n        An attacker with control of a network directory server may be able to execute arbitrary code with root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84607\n        AVEVideoEncoder\n        A sandboxed app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84631\n        Bluetooth\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43786\n        CoreServices\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84575\n        CoreUI\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43691\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84505\n        Directory Utility\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65362\n        Disk Images\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        NoYesNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43684\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.8HIGH\n        NoYesYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43689\n        Kernel\n        A malicious app may be able to gain root privileges\n        7.8HIGH\n        YesYesYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86917\n        Kernel\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64712\n        odproxyd\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84515\n        SMB\n        Connecting to a malicious SMB server may lead to kernel memory corruption\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84506\n        udf\n        An app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64761\n        Accessibility\n        An app may be able to identify what other apps a user has installed\n        7.5HIGH\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86895\n        CloudKit\n        A local app may be able to read a persistent account identifier\n        7.5HIGH\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84563\n        CUPS\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84606\n        iCloud\n        An app may be able to identify a user across reinstalls\n        7.5HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        7.5HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28969\n        IOKit\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65343\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65364\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86894\n        libxpc\n        An app may be able to break out of its sandbox\n        7.5HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84543\n        SMB\n        Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84553\n        smbx\n        A remote attacker may be able to cause a denial-of-service\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28930\n        Spotlight\n        An app may be able to access protected user data\n        7.5HIGH\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-86904\n        Watch App\n        An app may be able to track users across apps and websites without permission\n        7.5HIGH\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-64752\n        CoreMedia\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        7.3HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84611\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84632\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64736\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.1HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-65349\n        Kernel\n        An app may be able to cause unexpected system termination or read kernel memory\n        6.6MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84537\n        SMB\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.6MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43788\n        Spotlight\n        Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n        6.6MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86882\n        Accelerate Framework\n        Processing a maliciously crafted image may lead to unexpected process termination\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84519\n        AppleDouble\n        Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n        6.5MEDIUM\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86879\n        Baseband\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86885\n        Baseband\n        An attacker in radio range may be able to cause unexpected system termination\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65412\n        CoreText\n        Processing web content may lead to a denial-of-service\n        6.5MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-84596\n        CoreText\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84597\n        FontParser\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2022-3437\n        Heimdal\n        A user in a privileged network position may be able to leak sensitive user information\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28934\n        HFS\n        Mounting a malicious disk image may cause unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65347\n        ImageIO\n        Processing an image may lead to a denial-of-service\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65395\n        ImageIO\n        Processing a maliciously crafted image may result in memory corruption\n        6.5MEDIUM\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43687\n        Kernel\n        Connecting to a malicious NFS server may disclose kernel memory\n        6.5MEDIUM\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-65330\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84538\n        Kernel\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84588\n        Kernel\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84487\n        SceneKit\n        Processing a maliciously crafted file may result in disclosure of process memory\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43719\n        SMB\n        Mounting a maliciously crafted SMB network share may lead to system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65365\n        SMB\n        Connecting to a malicious SMB share may disclose kernel memory\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84536\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43677\n        WebDAV\n        Connecting to a malicious WebDAV server may lead to unexpected app termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64715\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64753\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-64787\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64778\n        WebKit History\n        Visiting a maliciously crafted website may leak sensitive data\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84560\n        Bluetooth\n        An app may gain unauthorized access to Bluetooth\n        6.1MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84619\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        6.1MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84554\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.9MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43664\n        Accessibility\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-65404\n        Accounts\n        A malicious application may be able to bypass Privacy preferences\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84523\n        APFS\n        An app may be able to cause unexpected system termination or write kernel memory\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84586\n        Apple Account\n        A malicious application may be able to leak sensitive user information\n        5.5MEDIUM\n        NoNoYesNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65407\n        AppleAVD\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84593\n        AppleKeyStore\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        5.5MEDIUM\n        NoNoNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86905\n        Authentication Services\n        An app may be able to delete credentials stored in Keychain\n        5.5MEDIUM\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43737\n        CoreMotion\n        An app may be able to access motion data from headphones without user consent\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84489\n        CoreUI\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84534\n        file_cmds\n        Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-65409\n        Foundation\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64756\n        Image Capture\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        YesNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64760\n        IOSurfaceAccelerator\n        An app may be able to leak sensitive kernel state\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65401\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65402\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65405\n        Kernel\n        An app may be able to determine kernel memory layout\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84517\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84521\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-86903\n        Kernel\n        An app may be able to disclose kernel memory\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86883\n        Managed Configuration\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43741\n        Messages\n        An app may be able to access protected user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84491\n        Photos Storage\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84576\n        QuartzCore\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84555\n        Sandbox\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65413\n        SceneKit\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28937\n        Terminal\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        5.5MEDIUM\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65393\n        Xcode IDE\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoYes\n      \n      \n        CVE-2026-84617\n        XPC\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64788\n        IOGPUFamily\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-65341\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-34979\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.3MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86876\n        CoreMedia\n        A sandboxed process may be able to circumvent sandbox restrictions\n        5.2MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86889\n        Security\n        An attacker in a privileged network position may be able to intercept network traffic\n        4.8MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84492\n        Graphics\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84630\n        Kernel\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43690\n        SMB\n        A local user may be able to read kernel memory\n        4.7MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84518\n        Safari\n        A malicious website may be able to determine what apps a user has installed\n        4.3MEDIUM\n        YesNoYesNoNoNoNoNoYesNo\n      \n      \n        CVE-2026-43795\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64780\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64781\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64784\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65331\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65332\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65333\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65334\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65335\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65336\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65337\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65338\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65340\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65351\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64782\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64779\n        WebKit Storage\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86910\n        APFS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86888\n        App Store\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesNoYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84587\n        AppKit\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-20683\n        Apple Account\n        An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n        TBDTBD\n        YesNoYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84601\n        Apple Intelligence\n        An app may be able to bypass Apple Intelligence security prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65408\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84520\n        AppleFDEKeyStore\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65381\n        AppleMobileFileIntegrity\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84522\n        Archive Utility\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84584\n        Archive Utility\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65342\n        ATS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84525\n        ATS\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65339\n        Audio\n        An app may be able to leak sensitive user information\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84583\n        AuthKit\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84570\n        autofs\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65410\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84616\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65406\n        BackgroundAssets\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-86878\n        Camera\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84567\n        cd9660\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86893\n        CloudKit\n        An app may be able to read device name\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65399\n        copyfile\n        An archive may be able to bypass Gatekeeper\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86891\n        Core Bluetooth\n        An app may be able to access Bluetooth device information\n        TBDTBD\n        NoNoYesYesYesNoYesNoNoNo\n      \n      \n        CVE-2026-43683\n        CoreDrag\n        An app may be able to cause unexpected process termination or disclose process memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43789\n        CoreMedia\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65344\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43702\n        CoreMedia Video Toolbox\n        Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n        TBDTBD\n        NoYesNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84624\n        CoreML\n        A sandboxed app may be able to access restricted files\n        TBDTBD\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84559\n        CoreServices\n        A malicious application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84574\n        CoreServices\n        An app may be able to bypass Privacy preferences\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84511\n        CoreUI\n        Processing a maliciously crafted asset catalog may lead to unexpected process termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84571\n        CoreUI\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64790\n        CUPS\n        An app may be able to gain elevated privileges\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84540\n        CUPS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84541\n        CUPS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84612\n        DeviceCheck\n        An app may be able to read persistent device identifiers\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84512\n        Disk Images\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84550\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84552\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84565\n        Disk Images\n        Processing a maliciously crafted disk image may lead to unexpected app termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84510\n        exFAT\n        Mounting a maliciously crafted volume may lead to unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86900\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86901\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43785\n        File Bookmark\n        An app may be able to modify a file it only had permission to read\n        TBDTBD\n        YesNoYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43688\n        Filters\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84524\n        FontParser\n        Processing a maliciously crafted font file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84569\n        Foundation\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86911\n        Foundation\n        A malicious app may be able to bypass clickjacking protections for secure prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84618\n        Game Center\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84533\n        Heimdal\n        An attacker in a privileged network position may be able to modify network traffic\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-64714\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84564\n        ImageIO\n        Processing a maliciously crafted image may result in disclosure of process memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86869\n        ImageIO\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        NoYesYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoYesNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65398\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65354\n        iWork\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28935\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-28968\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43790\n        Kernel\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65358\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65359\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65360\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65369\n        Kernel\n        A malicious application may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65371\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65377\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84507\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84530\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84544\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84549\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84558\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84561\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84566\n        Kernel\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84602\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84622\n        Kernel\n        An app with root privileges may be able to read uninitialized kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84514\n        Kext Management\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84556\n        Keychain Access\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65382\n        LaunchServices\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86870\n        libarchive\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84577\n        libxpc\n        An app may be able to bypass sandbox restrictions\n        TBDTBD\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43787\n        Mail\n        An attacker in a privileged network position may be able to leak sensitive user information\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84573\n        Mail\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84628\n        MediaRemote\n        A sandboxed app may be able to access the System Keychain\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86924\n        MobileAccessoryUpdater\n        Connecting a malicious accessory may cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65411\n        MobileBackup\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84598\n        MobileBackup\n        An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84497\n        Model I/O\n        Opening a maliciously crafted file may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84615\n        Music\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesNoNoNoYesNoYesNoNo\n      \n      \n        CVE-2026-43695\n        NetworkExtension\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84585\n        NetworkExtension\n        An app may be able to access local network devices without user consent\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84626\n        NetworkExtension\n        An app may be able to identify what other apps a user has installed\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86902\n        NSDocument\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84629\n        Photos Storage\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84623\n        Power Management\n        An app may be able to fingerprint the device\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84578\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84580\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84548\n        Quick Look\n        Processing a maliciously crafted document may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28966\n        RealityKit\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84532\n        RealityKit\n        Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-65403\n        Reminders\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86897\n        Safe Browsing\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65380\n        Sandbox\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84551\n        Sandbox\n        An app may be able to bypass network restrictions\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84603\n        Sandbox Profiles\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84625\n        Sandbox Profiles\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43697\n        SceneKit\n        Processing a maliciously crafted 3D file may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84526\n        SceneKit\n        Processing a maliciously crafted 3D scene may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84546\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84620\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84531\n        Security\n        Processing maliciously crafted NTLM input may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86881\n        Security\n        An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84600\n        Shortcuts\n        A malicious shortcut may be able to send messages without user confirmation\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86884\n        Siri\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-86890\n        Siri Suggestions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65376\n        SMB\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84509\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84609\n        Software Update\n        An app may be able to modify protected system files\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65361\n        SoftwareUpdate\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65378\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84621\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86892\n        SpringBoard\n        An app may be able to cause a denial-of-service\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65345\n        Storage\n        An app may be able to access user-sensitive data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65348\n        Storage\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43791\n        StorageKit\n        An app may be able to read arbitrary files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84513\n        Symptom Framework\n        A malicious application may be able to determine a user's current location\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65383\n        System Settings\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86909\n        System Settings\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84527\n        TCC\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84589\n        TCC\n        An app may be able to modify Privacy preferences\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86886\n        TCC\n        An app may be able to modify protected system files\n        TBDTBD\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65329\n        Telephony\n        An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86887\n        Time Zone\n        An app may be able to bypass certain Privacy preferences\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43696\n        Touch Bar\n        An app may be able to capture Touch Bar content without authorization\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84572\n        udf\n        An app may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28899\n        WebDAV\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65375\n        WebDAV\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-84635\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-86898\n        WebKit\n        Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n        TBDTBD\n        YesNoYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-84636\n        Wi-Fi Connectivity\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43674\n        Wi-Fi3\n        An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n    \n    \n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-09-16T22:00:52.706834Z"}, {"uuid": "d6738c1d-6a65-4818-8daf-4e1870c8da06", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28966", "type": "seen", "source": "https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026", "content": "Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.\nFor the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn\u2019t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.\nCVE-2026-65400 \u2014 Screen Sharing Server (9.8 CRITICAL, \u26a0 CISA KEV).  This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.\nCVE-2026-65414 \u2014 Bluetooth (9.8 CRITICAL). This is the highest-scored non-exploited bug in the release. It\u2019s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it \"automatable: yes, technical impact: total.\" It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.\nCVE-2026-65346 \u2014 ImageIO (8.8 HIGH).  The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.\nTwo honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) \u2014 a sandbox-to-kernel arbitrary-code-execution bug \u2014 and CVE-2026-43790 (Kernel) \u2014 remote kernel memory corruption \u2014 are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\nApple Security Updates \u2014 September 14, 2026 (v27)\n\n\n    \n      273Total CVEs\n      134Scored\n      139TBD\n      2CRITICAL\n      46HIGH\n      84MEDIUM\n      2LOW\n    \n    \nCVSS is the NVD primary score where available, otherwise CISA-ADP secondary; TBD = NVD has not scored it yet (most v27 CVEs are still under analysis). \u26a0 KEV marks CVEs in CISA's Known Exploited Vulnerabilities catalog.\n    \n    \n\n      Apple security release — September 14, 2026 (version 27), 273 CVEs. CVSS/Severity from NVD (National Vulnerability Database) as of Sept 16, 2026. CVE IDs link to NVD. \"Yes/No\" indicates whether each update is affected.\n      \n          CVE IDComponentImpactCVSSSeverity\n          iOS / iPadOS 27\n          iOS / iPadOS 26.7\n          macOS 27 (Golden Gate)\n          macOS Tahoe 26.7\n          macOS Sequoia 15.8\n          tvOS 27\n          watchOS 27\n          visionOS 27\n          Safari 27\n          Xcode 27\n      \n      \n      \n        CVE-2026-65400\n        Screen Sharing Server\n        An attacker on the network may be able to authenticate to Screen Sharing without valid credentials\n        9.8\u26a0 KEV CRITICAL\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65414\n        Bluetooth\n        A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n        9.8CRITICAL\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43692\n        CUPS\n        A remote user may cause an unexpected app termination or arbitrary code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65346\n        ImageIO\n        Processing an image may lead to arbitrary code execution\n        8.8HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-43686\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        8.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65374\n        WebDAV\n        Connecting to a malicious WebDAV server may result in code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43794\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65390\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65391\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        8.6HIGH\n        NoNoNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84581\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        8.4HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84535\n        Automator\n        An app may be able to break out of its sandbox\n        8.2HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84516\n        CUPS\n        Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory\n        8.1HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65415\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        8.1HIGH\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84568\n        autofs\n        An attacker with control of a network directory server may be able to execute arbitrary code with root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84607\n        AVEVideoEncoder\n        A sandboxed app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84631\n        Bluetooth\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43786\n        CoreServices\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84575\n        CoreUI\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43691\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84505\n        Directory Utility\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65362\n        Disk Images\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        NoYesNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43684\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.8HIGH\n        NoYesYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43689\n        Kernel\n        A malicious app may be able to gain root privileges\n        7.8HIGH\n        YesYesYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86917\n        Kernel\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64712\n        odproxyd\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84515\n        SMB\n        Connecting to a malicious SMB server may lead to kernel memory corruption\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84506\n        udf\n        An app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64761\n        Accessibility\n        An app may be able to identify what other apps a user has installed\n        7.5HIGH\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86895\n        CloudKit\n        A local app may be able to read a persistent account identifier\n        7.5HIGH\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84563\n        CUPS\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84606\n        iCloud\n        An app may be able to identify a user across reinstalls\n        7.5HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        7.5HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28969\n        IOKit\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65343\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65364\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86894\n        libxpc\n        An app may be able to break out of its sandbox\n        7.5HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84543\n        SMB\n        Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84553\n        smbx\n        A remote attacker may be able to cause a denial-of-service\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28930\n        Spotlight\n        An app may be able to access protected user data\n        7.5HIGH\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-86904\n        Watch App\n        An app may be able to track users across apps and websites without permission\n        7.5HIGH\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-64752\n        CoreMedia\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        7.3HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84611\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84632\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64736\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.1HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-65349\n        Kernel\n        An app may be able to cause unexpected system termination or read kernel memory\n        6.6MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84537\n        SMB\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.6MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43788\n        Spotlight\n        Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n        6.6MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86882\n        Accelerate Framework\n        Processing a maliciously crafted image may lead to unexpected process termination\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84519\n        AppleDouble\n        Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n        6.5MEDIUM\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86879\n        Baseband\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86885\n        Baseband\n        An attacker in radio range may be able to cause unexpected system termination\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65412\n        CoreText\n        Processing web content may lead to a denial-of-service\n        6.5MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-84596\n        CoreText\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84597\n        FontParser\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2022-3437\n        Heimdal\n        A user in a privileged network position may be able to leak sensitive user information\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28934\n        HFS\n        Mounting a malicious disk image may cause unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65347\n        ImageIO\n        Processing an image may lead to a denial-of-service\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65395\n        ImageIO\n        Processing a maliciously crafted image may result in memory corruption\n        6.5MEDIUM\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43687\n        Kernel\n        Connecting to a malicious NFS server may disclose kernel memory\n        6.5MEDIUM\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-65330\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84538\n        Kernel\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84588\n        Kernel\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84487\n        SceneKit\n        Processing a maliciously crafted file may result in disclosure of process memory\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43719\n        SMB\n        Mounting a maliciously crafted SMB network share may lead to system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65365\n        SMB\n        Connecting to a malicious SMB share may disclose kernel memory\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84536\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43677\n        WebDAV\n        Connecting to a malicious WebDAV server may lead to unexpected app termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64715\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64753\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-64787\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64778\n        WebKit History\n        Visiting a maliciously crafted website may leak sensitive data\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84560\n        Bluetooth\n        An app may gain unauthorized access to Bluetooth\n        6.1MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84619\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        6.1MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84554\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.9MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43664\n        Accessibility\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-65404\n        Accounts\n        A malicious application may be able to bypass Privacy preferences\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84523\n        APFS\n        An app may be able to cause unexpected system termination or write kernel memory\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84586\n        Apple Account\n        A malicious application may be able to leak sensitive user information\n        5.5MEDIUM\n        NoNoYesNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65407\n        AppleAVD\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84593\n        AppleKeyStore\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        5.5MEDIUM\n        NoNoNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86905\n        Authentication Services\n        An app may be able to delete credentials stored in Keychain\n        5.5MEDIUM\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43737\n        CoreMotion\n        An app may be able to access motion data from headphones without user consent\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84489\n        CoreUI\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84534\n        file_cmds\n        Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-65409\n        Foundation\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64756\n        Image Capture\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        YesNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64760\n        IOSurfaceAccelerator\n        An app may be able to leak sensitive kernel state\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65401\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65402\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65405\n        Kernel\n        An app may be able to determine kernel memory layout\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84517\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84521\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-86903\n        Kernel\n        An app may be able to disclose kernel memory\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86883\n        Managed Configuration\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43741\n        Messages\n        An app may be able to access protected user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84491\n        Photos Storage\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84576\n        QuartzCore\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84555\n        Sandbox\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65413\n        SceneKit\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28937\n        Terminal\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        5.5MEDIUM\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65393\n        Xcode IDE\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoYes\n      \n      \n        CVE-2026-84617\n        XPC\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64788\n        IOGPUFamily\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-65341\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-34979\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.3MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86876\n        CoreMedia\n        A sandboxed process may be able to circumvent sandbox restrictions\n        5.2MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86889\n        Security\n        An attacker in a privileged network position may be able to intercept network traffic\n        4.8MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84492\n        Graphics\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84630\n        Kernel\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43690\n        SMB\n        A local user may be able to read kernel memory\n        4.7MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84518\n        Safari\n        A malicious website may be able to determine what apps a user has installed\n        4.3MEDIUM\n        YesNoYesNoNoNoNoNoYesNo\n      \n      \n        CVE-2026-43795\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64780\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64781\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64784\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65331\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65332\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65333\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65334\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65335\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65336\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65337\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65338\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65340\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65351\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64782\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64779\n        WebKit Storage\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86910\n        APFS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86888\n        App Store\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesNoYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84587\n        AppKit\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-20683\n        Apple Account\n        An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n        TBDTBD\n        YesNoYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84601\n        Apple Intelligence\n        An app may be able to bypass Apple Intelligence security prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65408\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84520\n        AppleFDEKeyStore\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65381\n        AppleMobileFileIntegrity\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84522\n        Archive Utility\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84584\n        Archive Utility\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65342\n        ATS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84525\n        ATS\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65339\n        Audio\n        An app may be able to leak sensitive user information\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84583\n        AuthKit\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84570\n        autofs\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65410\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84616\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65406\n        BackgroundAssets\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-86878\n        Camera\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84567\n        cd9660\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86893\n        CloudKit\n        An app may be able to read device name\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65399\n        copyfile\n        An archive may be able to bypass Gatekeeper\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86891\n        Core Bluetooth\n        An app may be able to access Bluetooth device information\n        TBDTBD\n        NoNoYesYesYesNoYesNoNoNo\n      \n      \n        CVE-2026-43683\n        CoreDrag\n        An app may be able to cause unexpected process termination or disclose process memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43789\n        CoreMedia\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65344\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43702\n        CoreMedia Video Toolbox\n        Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n        TBDTBD\n        NoYesNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84624\n        CoreML\n        A sandboxed app may be able to access restricted files\n        TBDTBD\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84559\n        CoreServices\n        A malicious application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84574\n        CoreServices\n        An app may be able to bypass Privacy preferences\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84511\n        CoreUI\n        Processing a maliciously crafted asset catalog may lead to unexpected process termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84571\n        CoreUI\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64790\n        CUPS\n        An app may be able to gain elevated privileges\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84540\n        CUPS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84541\n        CUPS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84612\n        DeviceCheck\n        An app may be able to read persistent device identifiers\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84512\n        Disk Images\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84550\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84552\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84565\n        Disk Images\n        Processing a maliciously crafted disk image may lead to unexpected app termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84510\n        exFAT\n        Mounting a maliciously crafted volume may lead to unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86900\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86901\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43785\n        File Bookmark\n        An app may be able to modify a file it only had permission to read\n        TBDTBD\n        YesNoYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43688\n        Filters\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84524\n        FontParser\n        Processing a maliciously crafted font file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84569\n        Foundation\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86911\n        Foundation\n        A malicious app may be able to bypass clickjacking protections for secure prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84618\n        Game Center\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84533\n        Heimdal\n        An attacker in a privileged network position may be able to modify network traffic\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-64714\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84564\n        ImageIO\n        Processing a maliciously crafted image may result in disclosure of process memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86869\n        ImageIO\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        NoYesYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoYesNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65398\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65354\n        iWork\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28935\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-28968\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43790\n        Kernel\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65358\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65359\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65360\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65369\n        Kernel\n        A malicious application may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65371\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65377\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84507\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84530\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84544\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84549\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84558\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84561\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84566\n        Kernel\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84602\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84622\n        Kernel\n        An app with root privileges may be able to read uninitialized kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84514\n        Kext Management\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84556\n        Keychain Access\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65382\n        LaunchServices\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86870\n        libarchive\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84577\n        libxpc\n        An app may be able to bypass sandbox restrictions\n        TBDTBD\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43787\n        Mail\n        An attacker in a privileged network position may be able to leak sensitive user information\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84573\n        Mail\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84628\n        MediaRemote\n        A sandboxed app may be able to access the System Keychain\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86924\n        MobileAccessoryUpdater\n        Connecting a malicious accessory may cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65411\n        MobileBackup\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84598\n        MobileBackup\n        An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84497\n        Model I/O\n        Opening a maliciously crafted file may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84615\n        Music\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesNoNoNoYesNoYesNoNo\n      \n      \n        CVE-2026-43695\n        NetworkExtension\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84585\n        NetworkExtension\n        An app may be able to access local network devices without user consent\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84626\n        NetworkExtension\n        An app may be able to identify what other apps a user has installed\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86902\n        NSDocument\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84629\n        Photos Storage\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84623\n        Power Management\n        An app may be able to fingerprint the device\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84578\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84580\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84548\n        Quick Look\n        Processing a maliciously crafted document may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28966\n        RealityKit\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84532\n        RealityKit\n        Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-65403\n        Reminders\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86897\n        Safe Browsing\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65380\n        Sandbox\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84551\n        Sandbox\n        An app may be able to bypass network restrictions\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84603\n        Sandbox Profiles\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84625\n        Sandbox Profiles\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43697\n        SceneKit\n        Processing a maliciously crafted 3D file may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84526\n        SceneKit\n        Processing a maliciously crafted 3D scene may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84546\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84620\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84531\n        Security\n        Processing maliciously crafted NTLM input may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86881\n        Security\n        An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84600\n        Shortcuts\n        A malicious shortcut may be able to send messages without user confirmation\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86884\n        Siri\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-86890\n        Siri Suggestions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65376\n        SMB\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84509\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84609\n        Software Update\n        An app may be able to modify protected system files\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65361\n        SoftwareUpdate\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65378\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84621\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86892\n        SpringBoard\n        An app may be able to cause a denial-of-service\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65345\n        Storage\n        An app may be able to access user-sensitive data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65348\n        Storage\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43791\n        StorageKit\n        An app may be able to read arbitrary files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84513\n        Symptom Framework\n        A malicious application may be able to determine a user's current location\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65383\n        System Settings\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86909\n        System Settings\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84527\n        TCC\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84589\n        TCC\n        An app may be able to modify Privacy preferences\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86886\n        TCC\n        An app may be able to modify protected system files\n        TBDTBD\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65329\n        Telephony\n        An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86887\n        Time Zone\n        An app may be able to bypass certain Privacy preferences\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43696\n        Touch Bar\n        An app may be able to capture Touch Bar content without authorization\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84572\n        udf\n        An app may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28899\n        WebDAV\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65375\n        WebDAV\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-84635\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-86898\n        WebKit\n        Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n        TBDTBD\n        YesNoYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-84636\n        Wi-Fi Connectivity\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43674\n        Wi-Fi3\n        An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n    \n    \n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-09-16T22:01:44.297311Z"}, {"uuid": "e227de20-89d0-42e4-b6c5-4ff1e20219d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28930", "type": "seen", "source": "https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026", "content": "Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.\nFor the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn\u2019t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.\nCVE-2026-65400 \u2014 Screen Sharing Server (9.8 CRITICAL, \u26a0 CISA KEV).  This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.\nCVE-2026-65414 \u2014 Bluetooth (9.8 CRITICAL). This is the highest-scored non-exploited bug in the release. It\u2019s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it \"automatable: yes, technical impact: total.\" It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.\nCVE-2026-65346 \u2014 ImageIO (8.8 HIGH).  The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.\nTwo honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) \u2014 a sandbox-to-kernel arbitrary-code-execution bug \u2014 and CVE-2026-43790 (Kernel) \u2014 remote kernel memory corruption \u2014 are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\nApple Security Updates \u2014 September 14, 2026 (v27)\n\n\n    \n      273Total CVEs\n      134Scored\n      139TBD\n      2CRITICAL\n      46HIGH\n      84MEDIUM\n      2LOW\n    \n    \nCVSS is the NVD primary score where available, otherwise CISA-ADP secondary; TBD = NVD has not scored it yet (most v27 CVEs are still under analysis). \u26a0 KEV marks CVEs in CISA's Known Exploited Vulnerabilities catalog.\n    \n    \n\n      Apple security release — September 14, 2026 (version 27), 273 CVEs. CVSS/Severity from NVD (National Vulnerability Database) as of Sept 16, 2026. CVE IDs link to NVD. \"Yes/No\" indicates whether each update is affected.\n      \n          CVE IDComponentImpactCVSSSeverity\n          iOS / iPadOS 27\n          iOS / iPadOS 26.7\n          macOS 27 (Golden Gate)\n          macOS Tahoe 26.7\n          macOS Sequoia 15.8\n          tvOS 27\n          watchOS 27\n          visionOS 27\n          Safari 27\n          Xcode 27\n      \n      \n      \n        CVE-2026-65400\n        Screen Sharing Server\n        An attacker on the network may be able to authenticate to Screen Sharing without valid credentials\n        9.8\u26a0 KEV CRITICAL\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65414\n        Bluetooth\n        A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n        9.8CRITICAL\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43692\n        CUPS\n        A remote user may cause an unexpected app termination or arbitrary code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65346\n        ImageIO\n        Processing an image may lead to arbitrary code execution\n        8.8HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-43686\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        8.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65374\n        WebDAV\n        Connecting to a malicious WebDAV server may result in code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43794\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65390\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65391\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        8.6HIGH\n        NoNoNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84581\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        8.4HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84535\n        Automator\n        An app may be able to break out of its sandbox\n        8.2HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84516\n        CUPS\n        Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory\n        8.1HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65415\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        8.1HIGH\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84568\n        autofs\n        An attacker with control of a network directory server may be able to execute arbitrary code with root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84607\n        AVEVideoEncoder\n        A sandboxed app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84631\n        Bluetooth\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43786\n        CoreServices\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84575\n        CoreUI\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43691\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84505\n        Directory Utility\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65362\n        Disk Images\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        NoYesNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43684\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.8HIGH\n        NoYesYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43689\n        Kernel\n        A malicious app may be able to gain root privileges\n        7.8HIGH\n        YesYesYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86917\n        Kernel\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64712\n        odproxyd\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84515\n        SMB\n        Connecting to a malicious SMB server may lead to kernel memory corruption\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84506\n        udf\n        An app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64761\n        Accessibility\n        An app may be able to identify what other apps a user has installed\n        7.5HIGH\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86895\n        CloudKit\n        A local app may be able to read a persistent account identifier\n        7.5HIGH\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84563\n        CUPS\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84606\n        iCloud\n        An app may be able to identify a user across reinstalls\n        7.5HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        7.5HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28969\n        IOKit\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65343\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65364\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86894\n        libxpc\n        An app may be able to break out of its sandbox\n        7.5HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84543\n        SMB\n        Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84553\n        smbx\n        A remote attacker may be able to cause a denial-of-service\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28930\n        Spotlight\n        An app may be able to access protected user data\n        7.5HIGH\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-86904\n        Watch App\n        An app may be able to track users across apps and websites without permission\n        7.5HIGH\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-64752\n        CoreMedia\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        7.3HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84611\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84632\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64736\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.1HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-65349\n        Kernel\n        An app may be able to cause unexpected system termination or read kernel memory\n        6.6MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84537\n        SMB\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.6MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43788\n        Spotlight\n        Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n        6.6MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86882\n        Accelerate Framework\n        Processing a maliciously crafted image may lead to unexpected process termination\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84519\n        AppleDouble\n        Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n        6.5MEDIUM\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86879\n        Baseband\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86885\n        Baseband\n        An attacker in radio range may be able to cause unexpected system termination\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65412\n        CoreText\n        Processing web content may lead to a denial-of-service\n        6.5MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-84596\n        CoreText\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84597\n        FontParser\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2022-3437\n        Heimdal\n        A user in a privileged network position may be able to leak sensitive user information\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28934\n        HFS\n        Mounting a malicious disk image may cause unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65347\n        ImageIO\n        Processing an image may lead to a denial-of-service\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65395\n        ImageIO\n        Processing a maliciously crafted image may result in memory corruption\n        6.5MEDIUM\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43687\n        Kernel\n        Connecting to a malicious NFS server may disclose kernel memory\n        6.5MEDIUM\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-65330\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84538\n        Kernel\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84588\n        Kernel\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84487\n        SceneKit\n        Processing a maliciously crafted file may result in disclosure of process memory\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43719\n        SMB\n        Mounting a maliciously crafted SMB network share may lead to system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65365\n        SMB\n        Connecting to a malicious SMB share may disclose kernel memory\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84536\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43677\n        WebDAV\n        Connecting to a malicious WebDAV server may lead to unexpected app termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64715\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64753\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-64787\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64778\n        WebKit History\n        Visiting a maliciously crafted website may leak sensitive data\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84560\n        Bluetooth\n        An app may gain unauthorized access to Bluetooth\n        6.1MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84619\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        6.1MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84554\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.9MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43664\n        Accessibility\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-65404\n        Accounts\n        A malicious application may be able to bypass Privacy preferences\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84523\n        APFS\n        An app may be able to cause unexpected system termination or write kernel memory\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84586\n        Apple Account\n        A malicious application may be able to leak sensitive user information\n        5.5MEDIUM\n        NoNoYesNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65407\n        AppleAVD\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84593\n        AppleKeyStore\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        5.5MEDIUM\n        NoNoNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86905\n        Authentication Services\n        An app may be able to delete credentials stored in Keychain\n        5.5MEDIUM\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43737\n        CoreMotion\n        An app may be able to access motion data from headphones without user consent\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84489\n        CoreUI\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84534\n        file_cmds\n        Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-65409\n        Foundation\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64756\n        Image Capture\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        YesNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64760\n        IOSurfaceAccelerator\n        An app may be able to leak sensitive kernel state\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65401\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65402\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65405\n        Kernel\n        An app may be able to determine kernel memory layout\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84517\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84521\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-86903\n        Kernel\n        An app may be able to disclose kernel memory\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86883\n        Managed Configuration\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43741\n        Messages\n        An app may be able to access protected user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84491\n        Photos Storage\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84576\n        QuartzCore\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84555\n        Sandbox\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65413\n        SceneKit\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28937\n        Terminal\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        5.5MEDIUM\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65393\n        Xcode IDE\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoYes\n      \n      \n        CVE-2026-84617\n        XPC\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64788\n        IOGPUFamily\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-65341\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-34979\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.3MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86876\n        CoreMedia\n        A sandboxed process may be able to circumvent sandbox restrictions\n        5.2MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86889\n        Security\n        An attacker in a privileged network position may be able to intercept network traffic\n        4.8MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84492\n        Graphics\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84630\n        Kernel\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43690\n        SMB\n        A local user may be able to read kernel memory\n        4.7MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84518\n        Safari\n        A malicious website may be able to determine what apps a user has installed\n        4.3MEDIUM\n        YesNoYesNoNoNoNoNoYesNo\n      \n      \n        CVE-2026-43795\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64780\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64781\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64784\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65331\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65332\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65333\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65334\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65335\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65336\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65337\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65338\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65340\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65351\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64782\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64779\n        WebKit Storage\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86910\n        APFS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86888\n        App Store\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesNoYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84587\n        AppKit\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-20683\n        Apple Account\n        An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n        TBDTBD\n        YesNoYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84601\n        Apple Intelligence\n        An app may be able to bypass Apple Intelligence security prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65408\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84520\n        AppleFDEKeyStore\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65381\n        AppleMobileFileIntegrity\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84522\n        Archive Utility\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84584\n        Archive Utility\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65342\n        ATS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84525\n        ATS\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65339\n        Audio\n        An app may be able to leak sensitive user information\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84583\n        AuthKit\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84570\n        autofs\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65410\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84616\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65406\n        BackgroundAssets\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-86878\n        Camera\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84567\n        cd9660\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86893\n        CloudKit\n        An app may be able to read device name\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65399\n        copyfile\n        An archive may be able to bypass Gatekeeper\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86891\n        Core Bluetooth\n        An app may be able to access Bluetooth device information\n        TBDTBD\n        NoNoYesYesYesNoYesNoNoNo\n      \n      \n        CVE-2026-43683\n        CoreDrag\n        An app may be able to cause unexpected process termination or disclose process memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43789\n        CoreMedia\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65344\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43702\n        CoreMedia Video Toolbox\n        Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n        TBDTBD\n        NoYesNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84624\n        CoreML\n        A sandboxed app may be able to access restricted files\n        TBDTBD\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84559\n        CoreServices\n        A malicious application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84574\n        CoreServices\n        An app may be able to bypass Privacy preferences\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84511\n        CoreUI\n        Processing a maliciously crafted asset catalog may lead to unexpected process termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84571\n        CoreUI\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64790\n        CUPS\n        An app may be able to gain elevated privileges\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84540\n        CUPS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84541\n        CUPS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84612\n        DeviceCheck\n        An app may be able to read persistent device identifiers\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84512\n        Disk Images\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84550\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84552\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84565\n        Disk Images\n        Processing a maliciously crafted disk image may lead to unexpected app termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84510\n        exFAT\n        Mounting a maliciously crafted volume may lead to unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86900\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86901\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43785\n        File Bookmark\n        An app may be able to modify a file it only had permission to read\n        TBDTBD\n        YesNoYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43688\n        Filters\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84524\n        FontParser\n        Processing a maliciously crafted font file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84569\n        Foundation\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86911\n        Foundation\n        A malicious app may be able to bypass clickjacking protections for secure prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84618\n        Game Center\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84533\n        Heimdal\n        An attacker in a privileged network position may be able to modify network traffic\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-64714\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84564\n        ImageIO\n        Processing a maliciously crafted image may result in disclosure of process memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86869\n        ImageIO\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        NoYesYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoYesNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65398\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65354\n        iWork\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28935\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-28968\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43790\n        Kernel\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65358\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65359\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65360\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65369\n        Kernel\n        A malicious application may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65371\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65377\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84507\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84530\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84544\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84549\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84558\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84561\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84566\n        Kernel\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84602\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84622\n        Kernel\n        An app with root privileges may be able to read uninitialized kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84514\n        Kext Management\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84556\n        Keychain Access\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65382\n        LaunchServices\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86870\n        libarchive\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84577\n        libxpc\n        An app may be able to bypass sandbox restrictions\n        TBDTBD\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43787\n        Mail\n        An attacker in a privileged network position may be able to leak sensitive user information\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84573\n        Mail\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84628\n        MediaRemote\n        A sandboxed app may be able to access the System Keychain\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86924\n        MobileAccessoryUpdater\n        Connecting a malicious accessory may cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65411\n        MobileBackup\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84598\n        MobileBackup\n        An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84497\n        Model I/O\n        Opening a maliciously crafted file may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84615\n        Music\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesNoNoNoYesNoYesNoNo\n      \n      \n        CVE-2026-43695\n        NetworkExtension\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84585\n        NetworkExtension\n        An app may be able to access local network devices without user consent\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84626\n        NetworkExtension\n        An app may be able to identify what other apps a user has installed\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86902\n        NSDocument\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84629\n        Photos Storage\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84623\n        Power Management\n        An app may be able to fingerprint the device\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84578\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84580\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84548\n        Quick Look\n        Processing a maliciously crafted document may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28966\n        RealityKit\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84532\n        RealityKit\n        Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-65403\n        Reminders\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86897\n        Safe Browsing\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65380\n        Sandbox\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84551\n        Sandbox\n        An app may be able to bypass network restrictions\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84603\n        Sandbox Profiles\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84625\n        Sandbox Profiles\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43697\n        SceneKit\n        Processing a maliciously crafted 3D file may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84526\n        SceneKit\n        Processing a maliciously crafted 3D scene may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84546\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84620\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84531\n        Security\n        Processing maliciously crafted NTLM input may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86881\n        Security\n        An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84600\n        Shortcuts\n        A malicious shortcut may be able to send messages without user confirmation\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86884\n        Siri\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-86890\n        Siri Suggestions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65376\n        SMB\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84509\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84609\n        Software Update\n        An app may be able to modify protected system files\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65361\n        SoftwareUpdate\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65378\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84621\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86892\n        SpringBoard\n        An app may be able to cause a denial-of-service\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65345\n        Storage\n        An app may be able to access user-sensitive data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65348\n        Storage\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43791\n        StorageKit\n        An app may be able to read arbitrary files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84513\n        Symptom Framework\n        A malicious application may be able to determine a user's current location\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65383\n        System Settings\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86909\n        System Settings\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84527\n        TCC\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84589\n        TCC\n        An app may be able to modify Privacy preferences\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86886\n        TCC\n        An app may be able to modify protected system files\n        TBDTBD\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65329\n        Telephony\n        An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86887\n        Time Zone\n        An app may be able to bypass certain Privacy preferences\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43696\n        Touch Bar\n        An app may be able to capture Touch Bar content without authorization\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84572\n        udf\n        An app may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28899\n        WebDAV\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65375\n        WebDAV\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-84635\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-86898\n        WebKit\n        Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n        TBDTBD\n        YesNoYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-84636\n        Wi-Fi Connectivity\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43674\n        Wi-Fi3\n        An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n    \n    \n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-09-16T22:00:54.161642Z"}, {"uuid": "033a3ce1-72a1-474b-b4a3-4b931d95d91f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28934", "type": "seen", "source": "https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026", "content": "Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.\nFor the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn\u2019t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.\nCVE-2026-65400 \u2014 Screen Sharing Server (9.8 CRITICAL, \u26a0 CISA KEV).  This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.\nCVE-2026-65414 \u2014 Bluetooth (9.8 CRITICAL). This is the highest-scored non-exploited bug in the release. It\u2019s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it \"automatable: yes, technical impact: total.\" It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.\nCVE-2026-65346 \u2014 ImageIO (8.8 HIGH).  The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.\nTwo honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) \u2014 a sandbox-to-kernel arbitrary-code-execution bug \u2014 and CVE-2026-43790 (Kernel) \u2014 remote kernel memory corruption \u2014 are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\nApple Security Updates \u2014 September 14, 2026 (v27)\n\n\n    \n      273Total CVEs\n      134Scored\n      139TBD\n      2CRITICAL\n      46HIGH\n      84MEDIUM\n      2LOW\n    \n    \nCVSS is the NVD primary score where available, otherwise CISA-ADP secondary; TBD = NVD has not scored it yet (most v27 CVEs are still under analysis). \u26a0 KEV marks CVEs in CISA's Known Exploited Vulnerabilities catalog.\n    \n    \n\n      Apple security release — September 14, 2026 (version 27), 273 CVEs. CVSS/Severity from NVD (National Vulnerability Database) as of Sept 16, 2026. CVE IDs link to NVD. \"Yes/No\" indicates whether each update is affected.\n      \n          CVE IDComponentImpactCVSSSeverity\n          iOS / iPadOS 27\n          iOS / iPadOS 26.7\n          macOS 27 (Golden Gate)\n          macOS Tahoe 26.7\n          macOS Sequoia 15.8\n          tvOS 27\n          watchOS 27\n          visionOS 27\n          Safari 27\n          Xcode 27\n      \n      \n      \n        CVE-2026-65400\n        Screen Sharing Server\n        An attacker on the network may be able to authenticate to Screen Sharing without valid credentials\n        9.8\u26a0 KEV CRITICAL\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65414\n        Bluetooth\n        A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n        9.8CRITICAL\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43692\n        CUPS\n        A remote user may cause an unexpected app termination or arbitrary code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65346\n        ImageIO\n        Processing an image may lead to arbitrary code execution\n        8.8HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-43686\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        8.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65374\n        WebDAV\n        Connecting to a malicious WebDAV server may result in code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43794\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65390\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65391\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        8.6HIGH\n        NoNoNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84581\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        8.4HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84535\n        Automator\n        An app may be able to break out of its sandbox\n        8.2HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84516\n        CUPS\n        Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory\n        8.1HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65415\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        8.1HIGH\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84568\n        autofs\n        An attacker with control of a network directory server may be able to execute arbitrary code with root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84607\n        AVEVideoEncoder\n        A sandboxed app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84631\n        Bluetooth\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43786\n        CoreServices\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84575\n        CoreUI\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43691\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84505\n        Directory Utility\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65362\n        Disk Images\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        NoYesNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43684\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.8HIGH\n        NoYesYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43689\n        Kernel\n        A malicious app may be able to gain root privileges\n        7.8HIGH\n        YesYesYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86917\n        Kernel\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64712\n        odproxyd\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84515\n        SMB\n        Connecting to a malicious SMB server may lead to kernel memory corruption\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84506\n        udf\n        An app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64761\n        Accessibility\n        An app may be able to identify what other apps a user has installed\n        7.5HIGH\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86895\n        CloudKit\n        A local app may be able to read a persistent account identifier\n        7.5HIGH\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84563\n        CUPS\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84606\n        iCloud\n        An app may be able to identify a user across reinstalls\n        7.5HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        7.5HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28969\n        IOKit\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65343\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65364\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86894\n        libxpc\n        An app may be able to break out of its sandbox\n        7.5HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84543\n        SMB\n        Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84553\n        smbx\n        A remote attacker may be able to cause a denial-of-service\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28930\n        Spotlight\n        An app may be able to access protected user data\n        7.5HIGH\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-86904\n        Watch App\n        An app may be able to track users across apps and websites without permission\n        7.5HIGH\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-64752\n        CoreMedia\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        7.3HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84611\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84632\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64736\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.1HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-65349\n        Kernel\n        An app may be able to cause unexpected system termination or read kernel memory\n        6.6MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84537\n        SMB\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.6MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43788\n        Spotlight\n        Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n        6.6MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86882\n        Accelerate Framework\n        Processing a maliciously crafted image may lead to unexpected process termination\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84519\n        AppleDouble\n        Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n        6.5MEDIUM\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86879\n        Baseband\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86885\n        Baseband\n        An attacker in radio range may be able to cause unexpected system termination\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65412\n        CoreText\n        Processing web content may lead to a denial-of-service\n        6.5MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-84596\n        CoreText\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84597\n        FontParser\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2022-3437\n        Heimdal\n        A user in a privileged network position may be able to leak sensitive user information\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28934\n        HFS\n        Mounting a malicious disk image may cause unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65347\n        ImageIO\n        Processing an image may lead to a denial-of-service\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65395\n        ImageIO\n        Processing a maliciously crafted image may result in memory corruption\n        6.5MEDIUM\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43687\n        Kernel\n        Connecting to a malicious NFS server may disclose kernel memory\n        6.5MEDIUM\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-65330\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84538\n        Kernel\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84588\n        Kernel\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84487\n        SceneKit\n        Processing a maliciously crafted file may result in disclosure of process memory\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43719\n        SMB\n        Mounting a maliciously crafted SMB network share may lead to system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65365\n        SMB\n        Connecting to a malicious SMB share may disclose kernel memory\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84536\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43677\n        WebDAV\n        Connecting to a malicious WebDAV server may lead to unexpected app termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64715\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64753\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-64787\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64778\n        WebKit History\n        Visiting a maliciously crafted website may leak sensitive data\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84560\n        Bluetooth\n        An app may gain unauthorized access to Bluetooth\n        6.1MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84619\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        6.1MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84554\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.9MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43664\n        Accessibility\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-65404\n        Accounts\n        A malicious application may be able to bypass Privacy preferences\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84523\n        APFS\n        An app may be able to cause unexpected system termination or write kernel memory\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84586\n        Apple Account\n        A malicious application may be able to leak sensitive user information\n        5.5MEDIUM\n        NoNoYesNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65407\n        AppleAVD\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84593\n        AppleKeyStore\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        5.5MEDIUM\n        NoNoNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86905\n        Authentication Services\n        An app may be able to delete credentials stored in Keychain\n        5.5MEDIUM\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43737\n        CoreMotion\n        An app may be able to access motion data from headphones without user consent\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84489\n        CoreUI\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84534\n        file_cmds\n        Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-65409\n        Foundation\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64756\n        Image Capture\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        YesNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64760\n        IOSurfaceAccelerator\n        An app may be able to leak sensitive kernel state\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65401\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65402\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65405\n        Kernel\n        An app may be able to determine kernel memory layout\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84517\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84521\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-86903\n        Kernel\n        An app may be able to disclose kernel memory\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86883\n        Managed Configuration\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43741\n        Messages\n        An app may be able to access protected user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84491\n        Photos Storage\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84576\n        QuartzCore\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84555\n        Sandbox\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65413\n        SceneKit\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28937\n        Terminal\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        5.5MEDIUM\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65393\n        Xcode IDE\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoYes\n      \n      \n        CVE-2026-84617\n        XPC\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64788\n        IOGPUFamily\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-65341\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-34979\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.3MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86876\n        CoreMedia\n        A sandboxed process may be able to circumvent sandbox restrictions\n        5.2MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86889\n        Security\n        An attacker in a privileged network position may be able to intercept network traffic\n        4.8MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84492\n        Graphics\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84630\n        Kernel\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43690\n        SMB\n        A local user may be able to read kernel memory\n        4.7MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84518\n        Safari\n        A malicious website may be able to determine what apps a user has installed\n        4.3MEDIUM\n        YesNoYesNoNoNoNoNoYesNo\n      \n      \n        CVE-2026-43795\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64780\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64781\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64784\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65331\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65332\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65333\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65334\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65335\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65336\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65337\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65338\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65340\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65351\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64782\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64779\n        WebKit Storage\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86910\n        APFS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86888\n        App Store\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesNoYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84587\n        AppKit\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-20683\n        Apple Account\n        An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n        TBDTBD\n        YesNoYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84601\n        Apple Intelligence\n        An app may be able to bypass Apple Intelligence security prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65408\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84520\n        AppleFDEKeyStore\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65381\n        AppleMobileFileIntegrity\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84522\n        Archive Utility\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84584\n        Archive Utility\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65342\n        ATS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84525\n        ATS\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65339\n        Audio\n        An app may be able to leak sensitive user information\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84583\n        AuthKit\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84570\n        autofs\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65410\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84616\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65406\n        BackgroundAssets\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-86878\n        Camera\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84567\n        cd9660\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86893\n        CloudKit\n        An app may be able to read device name\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65399\n        copyfile\n        An archive may be able to bypass Gatekeeper\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86891\n        Core Bluetooth\n        An app may be able to access Bluetooth device information\n        TBDTBD\n        NoNoYesYesYesNoYesNoNoNo\n      \n      \n        CVE-2026-43683\n        CoreDrag\n        An app may be able to cause unexpected process termination or disclose process memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43789\n        CoreMedia\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65344\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43702\n        CoreMedia Video Toolbox\n        Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n        TBDTBD\n        NoYesNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84624\n        CoreML\n        A sandboxed app may be able to access restricted files\n        TBDTBD\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84559\n        CoreServices\n        A malicious application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84574\n        CoreServices\n        An app may be able to bypass Privacy preferences\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84511\n        CoreUI\n        Processing a maliciously crafted asset catalog may lead to unexpected process termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84571\n        CoreUI\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64790\n        CUPS\n        An app may be able to gain elevated privileges\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84540\n        CUPS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84541\n        CUPS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84612\n        DeviceCheck\n        An app may be able to read persistent device identifiers\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84512\n        Disk Images\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84550\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84552\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84565\n        Disk Images\n        Processing a maliciously crafted disk image may lead to unexpected app termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84510\n        exFAT\n        Mounting a maliciously crafted volume may lead to unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86900\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86901\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43785\n        File Bookmark\n        An app may be able to modify a file it only had permission to read\n        TBDTBD\n        YesNoYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43688\n        Filters\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84524\n        FontParser\n        Processing a maliciously crafted font file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84569\n        Foundation\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86911\n        Foundation\n        A malicious app may be able to bypass clickjacking protections for secure prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84618\n        Game Center\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84533\n        Heimdal\n        An attacker in a privileged network position may be able to modify network traffic\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-64714\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84564\n        ImageIO\n        Processing a maliciously crafted image may result in disclosure of process memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86869\n        ImageIO\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        NoYesYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoYesNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65398\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65354\n        iWork\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28935\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-28968\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43790\n        Kernel\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65358\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65359\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65360\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65369\n        Kernel\n        A malicious application may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65371\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65377\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84507\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84530\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84544\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84549\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84558\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84561\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84566\n        Kernel\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84602\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84622\n        Kernel\n        An app with root privileges may be able to read uninitialized kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84514\n        Kext Management\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84556\n        Keychain Access\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65382\n        LaunchServices\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86870\n        libarchive\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84577\n        libxpc\n        An app may be able to bypass sandbox restrictions\n        TBDTBD\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43787\n        Mail\n        An attacker in a privileged network position may be able to leak sensitive user information\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84573\n        Mail\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84628\n        MediaRemote\n        A sandboxed app may be able to access the System Keychain\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86924\n        MobileAccessoryUpdater\n        Connecting a malicious accessory may cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65411\n        MobileBackup\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84598\n        MobileBackup\n        An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84497\n        Model I/O\n        Opening a maliciously crafted file may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84615\n        Music\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesNoNoNoYesNoYesNoNo\n      \n      \n        CVE-2026-43695\n        NetworkExtension\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84585\n        NetworkExtension\n        An app may be able to access local network devices without user consent\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84626\n        NetworkExtension\n        An app may be able to identify what other apps a user has installed\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86902\n        NSDocument\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84629\n        Photos Storage\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84623\n        Power Management\n        An app may be able to fingerprint the device\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84578\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84580\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84548\n        Quick Look\n        Processing a maliciously crafted document may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28966\n        RealityKit\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84532\n        RealityKit\n        Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-65403\n        Reminders\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86897\n        Safe Browsing\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65380\n        Sandbox\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84551\n        Sandbox\n        An app may be able to bypass network restrictions\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84603\n        Sandbox Profiles\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84625\n        Sandbox Profiles\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43697\n        SceneKit\n        Processing a maliciously crafted 3D file may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84526\n        SceneKit\n        Processing a maliciously crafted 3D scene may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84546\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84620\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84531\n        Security\n        Processing maliciously crafted NTLM input may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86881\n        Security\n        An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84600\n        Shortcuts\n        A malicious shortcut may be able to send messages without user confirmation\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86884\n        Siri\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-86890\n        Siri Suggestions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65376\n        SMB\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84509\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84609\n        Software Update\n        An app may be able to modify protected system files\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65361\n        SoftwareUpdate\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65378\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84621\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86892\n        SpringBoard\n        An app may be able to cause a denial-of-service\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65345\n        Storage\n        An app may be able to access user-sensitive data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65348\n        Storage\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43791\n        StorageKit\n        An app may be able to read arbitrary files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84513\n        Symptom Framework\n        A malicious application may be able to determine a user's current location\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65383\n        System Settings\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86909\n        System Settings\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84527\n        TCC\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84589\n        TCC\n        An app may be able to modify Privacy preferences\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86886\n        TCC\n        An app may be able to modify protected system files\n        TBDTBD\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65329\n        Telephony\n        An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86887\n        Time Zone\n        An app may be able to bypass certain Privacy preferences\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43696\n        Touch Bar\n        An app may be able to capture Touch Bar content without authorization\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84572\n        udf\n        An app may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28899\n        WebDAV\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65375\n        WebDAV\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-84635\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-86898\n        WebKit\n        Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n        TBDTBD\n        YesNoYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-84636\n        Wi-Fi Connectivity\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43674\n        Wi-Fi3\n        An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n    \n    \n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-09-16T22:00:58.252869Z"}, {"uuid": "53776a81-0e7b-4dc2-8c13-4a53dfa83868", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28935", "type": "seen", "source": "https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026", "content": "Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.\nFor the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn\u2019t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.\nCVE-2026-65400 \u2014 Screen Sharing Server (9.8 CRITICAL, \u26a0 CISA KEV).  This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.\nCVE-2026-65414 \u2014 Bluetooth (9.8 CRITICAL). This is the highest-scored non-exploited bug in the release. It\u2019s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it \"automatable: yes, technical impact: total.\" It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.\nCVE-2026-65346 \u2014 ImageIO (8.8 HIGH).  The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.\nTwo honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) \u2014 a sandbox-to-kernel arbitrary-code-execution bug \u2014 and CVE-2026-43790 (Kernel) \u2014 remote kernel memory corruption \u2014 are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\nApple Security Updates \u2014 September 14, 2026 (v27)\n\n\n    \n      273Total CVEs\n      134Scored\n      139TBD\n      2CRITICAL\n      46HIGH\n      84MEDIUM\n      2LOW\n    \n    \nCVSS is the NVD primary score where available, otherwise CISA-ADP secondary; TBD = NVD has not scored it yet (most v27 CVEs are still under analysis). \u26a0 KEV marks CVEs in CISA's Known Exploited Vulnerabilities catalog.\n    \n    \n\n      Apple security release — September 14, 2026 (version 27), 273 CVEs. CVSS/Severity from NVD (National Vulnerability Database) as of Sept 16, 2026. CVE IDs link to NVD. \"Yes/No\" indicates whether each update is affected.\n      \n          CVE IDComponentImpactCVSSSeverity\n          iOS / iPadOS 27\n          iOS / iPadOS 26.7\n          macOS 27 (Golden Gate)\n          macOS Tahoe 26.7\n          macOS Sequoia 15.8\n          tvOS 27\n          watchOS 27\n          visionOS 27\n          Safari 27\n          Xcode 27\n      \n      \n      \n        CVE-2026-65400\n        Screen Sharing Server\n        An attacker on the network may be able to authenticate to Screen Sharing without valid credentials\n        9.8\u26a0 KEV CRITICAL\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65414\n        Bluetooth\n        A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n        9.8CRITICAL\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43692\n        CUPS\n        A remote user may cause an unexpected app termination or arbitrary code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65346\n        ImageIO\n        Processing an image may lead to arbitrary code execution\n        8.8HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-43686\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        8.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65374\n        WebDAV\n        Connecting to a malicious WebDAV server may result in code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43794\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65390\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65391\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        8.6HIGH\n        NoNoNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84581\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        8.4HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84535\n        Automator\n        An app may be able to break out of its sandbox\n        8.2HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84516\n        CUPS\n        Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory\n        8.1HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65415\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        8.1HIGH\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84568\n        autofs\n        An attacker with control of a network directory server may be able to execute arbitrary code with root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84607\n        AVEVideoEncoder\n        A sandboxed app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84631\n        Bluetooth\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43786\n        CoreServices\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84575\n        CoreUI\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43691\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84505\n        Directory Utility\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65362\n        Disk Images\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        NoYesNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43684\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.8HIGH\n        NoYesYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43689\n        Kernel\n        A malicious app may be able to gain root privileges\n        7.8HIGH\n        YesYesYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86917\n        Kernel\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64712\n        odproxyd\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84515\n        SMB\n        Connecting to a malicious SMB server may lead to kernel memory corruption\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84506\n        udf\n        An app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64761\n        Accessibility\n        An app may be able to identify what other apps a user has installed\n        7.5HIGH\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86895\n        CloudKit\n        A local app may be able to read a persistent account identifier\n        7.5HIGH\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84563\n        CUPS\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84606\n        iCloud\n        An app may be able to identify a user across reinstalls\n        7.5HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        7.5HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28969\n        IOKit\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65343\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65364\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86894\n        libxpc\n        An app may be able to break out of its sandbox\n        7.5HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84543\n        SMB\n        Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84553\n        smbx\n        A remote attacker may be able to cause a denial-of-service\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28930\n        Spotlight\n        An app may be able to access protected user data\n        7.5HIGH\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-86904\n        Watch App\n        An app may be able to track users across apps and websites without permission\n        7.5HIGH\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-64752\n        CoreMedia\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        7.3HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84611\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84632\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64736\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.1HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-65349\n        Kernel\n        An app may be able to cause unexpected system termination or read kernel memory\n        6.6MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84537\n        SMB\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.6MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43788\n        Spotlight\n        Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n        6.6MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86882\n        Accelerate Framework\n        Processing a maliciously crafted image may lead to unexpected process termination\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84519\n        AppleDouble\n        Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n        6.5MEDIUM\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86879\n        Baseband\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86885\n        Baseband\n        An attacker in radio range may be able to cause unexpected system termination\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65412\n        CoreText\n        Processing web content may lead to a denial-of-service\n        6.5MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-84596\n        CoreText\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84597\n        FontParser\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2022-3437\n        Heimdal\n        A user in a privileged network position may be able to leak sensitive user information\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28934\n        HFS\n        Mounting a malicious disk image may cause unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65347\n        ImageIO\n        Processing an image may lead to a denial-of-service\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65395\n        ImageIO\n        Processing a maliciously crafted image may result in memory corruption\n        6.5MEDIUM\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43687\n        Kernel\n        Connecting to a malicious NFS server may disclose kernel memory\n        6.5MEDIUM\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-65330\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84538\n        Kernel\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84588\n        Kernel\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84487\n        SceneKit\n        Processing a maliciously crafted file may result in disclosure of process memory\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43719\n        SMB\n        Mounting a maliciously crafted SMB network share may lead to system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65365\n        SMB\n        Connecting to a malicious SMB share may disclose kernel memory\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84536\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43677\n        WebDAV\n        Connecting to a malicious WebDAV server may lead to unexpected app termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64715\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64753\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-64787\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64778\n        WebKit History\n        Visiting a maliciously crafted website may leak sensitive data\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84560\n        Bluetooth\n        An app may gain unauthorized access to Bluetooth\n        6.1MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84619\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        6.1MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84554\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.9MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43664\n        Accessibility\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-65404\n        Accounts\n        A malicious application may be able to bypass Privacy preferences\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84523\n        APFS\n        An app may be able to cause unexpected system termination or write kernel memory\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84586\n        Apple Account\n        A malicious application may be able to leak sensitive user information\n        5.5MEDIUM\n        NoNoYesNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65407\n        AppleAVD\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84593\n        AppleKeyStore\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        5.5MEDIUM\n        NoNoNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86905\n        Authentication Services\n        An app may be able to delete credentials stored in Keychain\n        5.5MEDIUM\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43737\n        CoreMotion\n        An app may be able to access motion data from headphones without user consent\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84489\n        CoreUI\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84534\n        file_cmds\n        Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-65409\n        Foundation\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64756\n        Image Capture\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        YesNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64760\n        IOSurfaceAccelerator\n        An app may be able to leak sensitive kernel state\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65401\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65402\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65405\n        Kernel\n        An app may be able to determine kernel memory layout\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84517\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84521\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-86903\n        Kernel\n        An app may be able to disclose kernel memory\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86883\n        Managed Configuration\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43741\n        Messages\n        An app may be able to access protected user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84491\n        Photos Storage\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84576\n        QuartzCore\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84555\n        Sandbox\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65413\n        SceneKit\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28937\n        Terminal\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        5.5MEDIUM\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65393\n        Xcode IDE\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoYes\n      \n      \n        CVE-2026-84617\n        XPC\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64788\n        IOGPUFamily\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-65341\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-34979\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.3MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86876\n        CoreMedia\n        A sandboxed process may be able to circumvent sandbox restrictions\n        5.2MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86889\n        Security\n        An attacker in a privileged network position may be able to intercept network traffic\n        4.8MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84492\n        Graphics\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84630\n        Kernel\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43690\n        SMB\n        A local user may be able to read kernel memory\n        4.7MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84518\n        Safari\n        A malicious website may be able to determine what apps a user has installed\n        4.3MEDIUM\n        YesNoYesNoNoNoNoNoYesNo\n      \n      \n        CVE-2026-43795\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64780\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64781\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64784\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65331\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65332\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65333\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65334\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65335\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65336\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65337\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65338\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65340\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65351\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64782\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64779\n        WebKit Storage\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86910\n        APFS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86888\n        App Store\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesNoYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84587\n        AppKit\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-20683\n        Apple Account\n        An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n        TBDTBD\n        YesNoYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84601\n        Apple Intelligence\n        An app may be able to bypass Apple Intelligence security prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65408\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84520\n        AppleFDEKeyStore\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65381\n        AppleMobileFileIntegrity\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84522\n        Archive Utility\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84584\n        Archive Utility\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65342\n        ATS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84525\n        ATS\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65339\n        Audio\n        An app may be able to leak sensitive user information\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84583\n        AuthKit\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84570\n        autofs\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65410\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84616\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65406\n        BackgroundAssets\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-86878\n        Camera\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84567\n        cd9660\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86893\n        CloudKit\n        An app may be able to read device name\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65399\n        copyfile\n        An archive may be able to bypass Gatekeeper\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86891\n        Core Bluetooth\n        An app may be able to access Bluetooth device information\n        TBDTBD\n        NoNoYesYesYesNoYesNoNoNo\n      \n      \n        CVE-2026-43683\n        CoreDrag\n        An app may be able to cause unexpected process termination or disclose process memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43789\n        CoreMedia\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65344\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43702\n        CoreMedia Video Toolbox\n        Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n        TBDTBD\n        NoYesNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84624\n        CoreML\n        A sandboxed app may be able to access restricted files\n        TBDTBD\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84559\n        CoreServices\n        A malicious application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84574\n        CoreServices\n        An app may be able to bypass Privacy preferences\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84511\n        CoreUI\n        Processing a maliciously crafted asset catalog may lead to unexpected process termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84571\n        CoreUI\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64790\n        CUPS\n        An app may be able to gain elevated privileges\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84540\n        CUPS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84541\n        CUPS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84612\n        DeviceCheck\n        An app may be able to read persistent device identifiers\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84512\n        Disk Images\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84550\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84552\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84565\n        Disk Images\n        Processing a maliciously crafted disk image may lead to unexpected app termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84510\n        exFAT\n        Mounting a maliciously crafted volume may lead to unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86900\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86901\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43785\n        File Bookmark\n        An app may be able to modify a file it only had permission to read\n        TBDTBD\n        YesNoYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43688\n        Filters\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84524\n        FontParser\n        Processing a maliciously crafted font file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84569\n        Foundation\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86911\n        Foundation\n        A malicious app may be able to bypass clickjacking protections for secure prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84618\n        Game Center\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84533\n        Heimdal\n        An attacker in a privileged network position may be able to modify network traffic\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-64714\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84564\n        ImageIO\n        Processing a maliciously crafted image may result in disclosure of process memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86869\n        ImageIO\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        NoYesYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoYesNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65398\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65354\n        iWork\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28935\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-28968\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43790\n        Kernel\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65358\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65359\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65360\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65369\n        Kernel\n        A malicious application may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65371\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65377\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84507\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84530\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84544\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84549\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84558\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84561\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84566\n        Kernel\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84602\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84622\n        Kernel\n        An app with root privileges may be able to read uninitialized kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84514\n        Kext Management\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84556\n        Keychain Access\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65382\n        LaunchServices\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86870\n        libarchive\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84577\n        libxpc\n        An app may be able to bypass sandbox restrictions\n        TBDTBD\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43787\n        Mail\n        An attacker in a privileged network position may be able to leak sensitive user information\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84573\n        Mail\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84628\n        MediaRemote\n        A sandboxed app may be able to access the System Keychain\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86924\n        MobileAccessoryUpdater\n        Connecting a malicious accessory may cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65411\n        MobileBackup\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84598\n        MobileBackup\n        An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84497\n        Model I/O\n        Opening a maliciously crafted file may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84615\n        Music\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesNoNoNoYesNoYesNoNo\n      \n      \n        CVE-2026-43695\n        NetworkExtension\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84585\n        NetworkExtension\n        An app may be able to access local network devices without user consent\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84626\n        NetworkExtension\n        An app may be able to identify what other apps a user has installed\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86902\n        NSDocument\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84629\n        Photos Storage\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84623\n        Power Management\n        An app may be able to fingerprint the device\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84578\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84580\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84548\n        Quick Look\n        Processing a maliciously crafted document may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28966\n        RealityKit\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84532\n        RealityKit\n        Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-65403\n        Reminders\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86897\n        Safe Browsing\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65380\n        Sandbox\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84551\n        Sandbox\n        An app may be able to bypass network restrictions\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84603\n        Sandbox Profiles\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84625\n        Sandbox Profiles\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43697\n        SceneKit\n        Processing a maliciously crafted 3D file may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84526\n        SceneKit\n        Processing a maliciously crafted 3D scene may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84546\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84620\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84531\n        Security\n        Processing maliciously crafted NTLM input may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86881\n        Security\n        An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84600\n        Shortcuts\n        A malicious shortcut may be able to send messages without user confirmation\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86884\n        Siri\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-86890\n        Siri Suggestions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65376\n        SMB\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84509\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84609\n        Software Update\n        An app may be able to modify protected system files\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65361\n        SoftwareUpdate\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65378\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84621\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86892\n        SpringBoard\n        An app may be able to cause a denial-of-service\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65345\n        Storage\n        An app may be able to access user-sensitive data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65348\n        Storage\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43791\n        StorageKit\n        An app may be able to read arbitrary files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84513\n        Symptom Framework\n        A malicious application may be able to determine a user's current location\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65383\n        System Settings\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86909\n        System Settings\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84527\n        TCC\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84589\n        TCC\n        An app may be able to modify Privacy preferences\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86886\n        TCC\n        An app may be able to modify protected system files\n        TBDTBD\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65329\n        Telephony\n        An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86887\n        Time Zone\n        An app may be able to bypass certain Privacy preferences\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43696\n        Touch Bar\n        An app may be able to capture Touch Bar content without authorization\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84572\n        udf\n        An app may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28899\n        WebDAV\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65375\n        WebDAV\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-84635\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-86898\n        WebKit\n        Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n        TBDTBD\n        YesNoYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-84636\n        Wi-Fi Connectivity\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43674\n        Wi-Fi3\n        An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n    \n    \n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-09-16T22:01:33.945660Z"}, {"uuid": "6fb10bed-3792-46d5-8151-352f23b0488b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28968", "type": "seen", "source": "https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026", "content": "Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.\nFor the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn\u2019t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.\nCVE-2026-65400 \u2014 Screen Sharing Server (9.8 CRITICAL, \u26a0 CISA KEV).  This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.\nCVE-2026-65414 \u2014 Bluetooth (9.8 CRITICAL). This is the highest-scored non-exploited bug in the release. It\u2019s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it \"automatable: yes, technical impact: total.\" It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.\nCVE-2026-65346 \u2014 ImageIO (8.8 HIGH).  The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.\nTwo honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) \u2014 a sandbox-to-kernel arbitrary-code-execution bug \u2014 and CVE-2026-43790 (Kernel) \u2014 remote kernel memory corruption \u2014 are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\nApple Security Updates \u2014 September 14, 2026 (v27)\n\n\n    \n      273Total CVEs\n      134Scored\n      139TBD\n      2CRITICAL\n      46HIGH\n      84MEDIUM\n      2LOW\n    \n    \nCVSS is the NVD primary score where available, otherwise CISA-ADP secondary; TBD = NVD has not scored it yet (most v27 CVEs are still under analysis). \u26a0 KEV marks CVEs in CISA's Known Exploited Vulnerabilities catalog.\n    \n    \n\n      Apple security release — September 14, 2026 (version 27), 273 CVEs. CVSS/Severity from NVD (National Vulnerability Database) as of Sept 16, 2026. CVE IDs link to NVD. \"Yes/No\" indicates whether each update is affected.\n      \n          CVE IDComponentImpactCVSSSeverity\n          iOS / iPadOS 27\n          iOS / iPadOS 26.7\n          macOS 27 (Golden Gate)\n          macOS Tahoe 26.7\n          macOS Sequoia 15.8\n          tvOS 27\n          watchOS 27\n          visionOS 27\n          Safari 27\n          Xcode 27\n      \n      \n      \n        CVE-2026-65400\n        Screen Sharing Server\n        An attacker on the network may be able to authenticate to Screen Sharing without valid credentials\n        9.8\u26a0 KEV CRITICAL\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65414\n        Bluetooth\n        A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n        9.8CRITICAL\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43692\n        CUPS\n        A remote user may cause an unexpected app termination or arbitrary code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65346\n        ImageIO\n        Processing an image may lead to arbitrary code execution\n        8.8HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-43686\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        8.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65374\n        WebDAV\n        Connecting to a malicious WebDAV server may result in code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43794\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65390\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65391\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        8.6HIGH\n        NoNoNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84581\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        8.4HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84535\n        Automator\n        An app may be able to break out of its sandbox\n        8.2HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84516\n        CUPS\n        Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory\n        8.1HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65415\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        8.1HIGH\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84568\n        autofs\n        An attacker with control of a network directory server may be able to execute arbitrary code with root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84607\n        AVEVideoEncoder\n        A sandboxed app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84631\n        Bluetooth\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43786\n        CoreServices\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84575\n        CoreUI\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43691\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84505\n        Directory Utility\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65362\n        Disk Images\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        NoYesNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43684\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.8HIGH\n        NoYesYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43689\n        Kernel\n        A malicious app may be able to gain root privileges\n        7.8HIGH\n        YesYesYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86917\n        Kernel\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64712\n        odproxyd\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84515\n        SMB\n        Connecting to a malicious SMB server may lead to kernel memory corruption\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84506\n        udf\n        An app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64761\n        Accessibility\n        An app may be able to identify what other apps a user has installed\n        7.5HIGH\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86895\n        CloudKit\n        A local app may be able to read a persistent account identifier\n        7.5HIGH\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84563\n        CUPS\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84606\n        iCloud\n        An app may be able to identify a user across reinstalls\n        7.5HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        7.5HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28969\n        IOKit\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65343\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65364\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86894\n        libxpc\n        An app may be able to break out of its sandbox\n        7.5HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84543\n        SMB\n        Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84553\n        smbx\n        A remote attacker may be able to cause a denial-of-service\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28930\n        Spotlight\n        An app may be able to access protected user data\n        7.5HIGH\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-86904\n        Watch App\n        An app may be able to track users across apps and websites without permission\n        7.5HIGH\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-64752\n        CoreMedia\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        7.3HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84611\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84632\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64736\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.1HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-65349\n        Kernel\n        An app may be able to cause unexpected system termination or read kernel memory\n        6.6MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84537\n        SMB\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.6MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43788\n        Spotlight\n        Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n        6.6MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86882\n        Accelerate Framework\n        Processing a maliciously crafted image may lead to unexpected process termination\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84519\n        AppleDouble\n        Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n        6.5MEDIUM\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86879\n        Baseband\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86885\n        Baseband\n        An attacker in radio range may be able to cause unexpected system termination\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65412\n        CoreText\n        Processing web content may lead to a denial-of-service\n        6.5MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-84596\n        CoreText\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84597\n        FontParser\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2022-3437\n        Heimdal\n        A user in a privileged network position may be able to leak sensitive user information\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28934\n        HFS\n        Mounting a malicious disk image may cause unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65347\n        ImageIO\n        Processing an image may lead to a denial-of-service\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65395\n        ImageIO\n        Processing a maliciously crafted image may result in memory corruption\n        6.5MEDIUM\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43687\n        Kernel\n        Connecting to a malicious NFS server may disclose kernel memory\n        6.5MEDIUM\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-65330\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84538\n        Kernel\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84588\n        Kernel\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84487\n        SceneKit\n        Processing a maliciously crafted file may result in disclosure of process memory\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43719\n        SMB\n        Mounting a maliciously crafted SMB network share may lead to system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65365\n        SMB\n        Connecting to a malicious SMB share may disclose kernel memory\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84536\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43677\n        WebDAV\n        Connecting to a malicious WebDAV server may lead to unexpected app termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64715\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64753\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-64787\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64778\n        WebKit History\n        Visiting a maliciously crafted website may leak sensitive data\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84560\n        Bluetooth\n        An app may gain unauthorized access to Bluetooth\n        6.1MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84619\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        6.1MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84554\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.9MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43664\n        Accessibility\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-65404\n        Accounts\n        A malicious application may be able to bypass Privacy preferences\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84523\n        APFS\n        An app may be able to cause unexpected system termination or write kernel memory\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84586\n        Apple Account\n        A malicious application may be able to leak sensitive user information\n        5.5MEDIUM\n        NoNoYesNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65407\n        AppleAVD\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84593\n        AppleKeyStore\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        5.5MEDIUM\n        NoNoNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86905\n        Authentication Services\n        An app may be able to delete credentials stored in Keychain\n        5.5MEDIUM\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43737\n        CoreMotion\n        An app may be able to access motion data from headphones without user consent\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84489\n        CoreUI\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84534\n        file_cmds\n        Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-65409\n        Foundation\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64756\n        Image Capture\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        YesNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64760\n        IOSurfaceAccelerator\n        An app may be able to leak sensitive kernel state\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65401\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65402\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65405\n        Kernel\n        An app may be able to determine kernel memory layout\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84517\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84521\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-86903\n        Kernel\n        An app may be able to disclose kernel memory\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86883\n        Managed Configuration\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43741\n        Messages\n        An app may be able to access protected user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84491\n        Photos Storage\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84576\n        QuartzCore\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84555\n        Sandbox\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65413\n        SceneKit\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28937\n        Terminal\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        5.5MEDIUM\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65393\n        Xcode IDE\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoYes\n      \n      \n        CVE-2026-84617\n        XPC\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64788\n        IOGPUFamily\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-65341\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-34979\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.3MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86876\n        CoreMedia\n        A sandboxed process may be able to circumvent sandbox restrictions\n        5.2MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86889\n        Security\n        An attacker in a privileged network position may be able to intercept network traffic\n        4.8MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84492\n        Graphics\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84630\n        Kernel\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43690\n        SMB\n        A local user may be able to read kernel memory\n        4.7MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84518\n        Safari\n        A malicious website may be able to determine what apps a user has installed\n        4.3MEDIUM\n        YesNoYesNoNoNoNoNoYesNo\n      \n      \n        CVE-2026-43795\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64780\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64781\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64784\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65331\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65332\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65333\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65334\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65335\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65336\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65337\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65338\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65340\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65351\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64782\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64779\n        WebKit Storage\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86910\n        APFS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86888\n        App Store\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesNoYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84587\n        AppKit\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-20683\n        Apple Account\n        An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n        TBDTBD\n        YesNoYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84601\n        Apple Intelligence\n        An app may be able to bypass Apple Intelligence security prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65408\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84520\n        AppleFDEKeyStore\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65381\n        AppleMobileFileIntegrity\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84522\n        Archive Utility\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84584\n        Archive Utility\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65342\n        ATS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84525\n        ATS\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65339\n        Audio\n        An app may be able to leak sensitive user information\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84583\n        AuthKit\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84570\n        autofs\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65410\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84616\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65406\n        BackgroundAssets\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-86878\n        Camera\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84567\n        cd9660\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86893\n        CloudKit\n        An app may be able to read device name\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65399\n        copyfile\n        An archive may be able to bypass Gatekeeper\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86891\n        Core Bluetooth\n        An app may be able to access Bluetooth device information\n        TBDTBD\n        NoNoYesYesYesNoYesNoNoNo\n      \n      \n        CVE-2026-43683\n        CoreDrag\n        An app may be able to cause unexpected process termination or disclose process memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43789\n        CoreMedia\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65344\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43702\n        CoreMedia Video Toolbox\n        Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n        TBDTBD\n        NoYesNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84624\n        CoreML\n        A sandboxed app may be able to access restricted files\n        TBDTBD\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84559\n        CoreServices\n        A malicious application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84574\n        CoreServices\n        An app may be able to bypass Privacy preferences\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84511\n        CoreUI\n        Processing a maliciously crafted asset catalog may lead to unexpected process termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84571\n        CoreUI\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64790\n        CUPS\n        An app may be able to gain elevated privileges\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84540\n        CUPS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84541\n        CUPS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84612\n        DeviceCheck\n        An app may be able to read persistent device identifiers\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84512\n        Disk Images\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84550\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84552\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84565\n        Disk Images\n        Processing a maliciously crafted disk image may lead to unexpected app termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84510\n        exFAT\n        Mounting a maliciously crafted volume may lead to unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86900\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86901\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43785\n        File Bookmark\n        An app may be able to modify a file it only had permission to read\n        TBDTBD\n        YesNoYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43688\n        Filters\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84524\n        FontParser\n        Processing a maliciously crafted font file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84569\n        Foundation\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86911\n        Foundation\n        A malicious app may be able to bypass clickjacking protections for secure prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84618\n        Game Center\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84533\n        Heimdal\n        An attacker in a privileged network position may be able to modify network traffic\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-64714\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84564\n        ImageIO\n        Processing a maliciously crafted image may result in disclosure of process memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86869\n        ImageIO\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        NoYesYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoYesNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65398\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65354\n        iWork\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28935\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-28968\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43790\n        Kernel\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65358\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65359\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65360\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65369\n        Kernel\n        A malicious application may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65371\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65377\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84507\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84530\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84544\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84549\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84558\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84561\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84566\n        Kernel\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84602\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84622\n        Kernel\n        An app with root privileges may be able to read uninitialized kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84514\n        Kext Management\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84556\n        Keychain Access\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65382\n        LaunchServices\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86870\n        libarchive\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84577\n        libxpc\n        An app may be able to bypass sandbox restrictions\n        TBDTBD\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43787\n        Mail\n        An attacker in a privileged network position may be able to leak sensitive user information\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84573\n        Mail\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84628\n        MediaRemote\n        A sandboxed app may be able to access the System Keychain\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86924\n        MobileAccessoryUpdater\n        Connecting a malicious accessory may cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65411\n        MobileBackup\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84598\n        MobileBackup\n        An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84497\n        Model I/O\n        Opening a maliciously crafted file may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84615\n        Music\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesNoNoNoYesNoYesNoNo\n      \n      \n        CVE-2026-43695\n        NetworkExtension\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84585\n        NetworkExtension\n        An app may be able to access local network devices without user consent\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84626\n        NetworkExtension\n        An app may be able to identify what other apps a user has installed\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86902\n        NSDocument\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84629\n        Photos Storage\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84623\n        Power Management\n        An app may be able to fingerprint the device\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84578\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84580\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84548\n        Quick Look\n        Processing a maliciously crafted document may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28966\n        RealityKit\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84532\n        RealityKit\n        Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-65403\n        Reminders\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86897\n        Safe Browsing\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65380\n        Sandbox\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84551\n        Sandbox\n        An app may be able to bypass network restrictions\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84603\n        Sandbox Profiles\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84625\n        Sandbox Profiles\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43697\n        SceneKit\n        Processing a maliciously crafted 3D file may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84526\n        SceneKit\n        Processing a maliciously crafted 3D scene may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84546\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84620\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84531\n        Security\n        Processing maliciously crafted NTLM input may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86881\n        Security\n        An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84600\n        Shortcuts\n        A malicious shortcut may be able to send messages without user confirmation\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86884\n        Siri\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-86890\n        Siri Suggestions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65376\n        SMB\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84509\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84609\n        Software Update\n        An app may be able to modify protected system files\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65361\n        SoftwareUpdate\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65378\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84621\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86892\n        SpringBoard\n        An app may be able to cause a denial-of-service\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65345\n        Storage\n        An app may be able to access user-sensitive data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65348\n        Storage\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43791\n        StorageKit\n        An app may be able to read arbitrary files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84513\n        Symptom Framework\n        A malicious application may be able to determine a user's current location\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65383\n        System Settings\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86909\n        System Settings\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84527\n        TCC\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84589\n        TCC\n        An app may be able to modify Privacy preferences\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86886\n        TCC\n        An app may be able to modify protected system files\n        TBDTBD\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65329\n        Telephony\n        An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86887\n        Time Zone\n        An app may be able to bypass certain Privacy preferences\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43696\n        Touch Bar\n        An app may be able to capture Touch Bar content without authorization\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84572\n        udf\n        An app may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28899\n        WebDAV\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65375\n        WebDAV\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-84635\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-86898\n        WebKit\n        Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n        TBDTBD\n        YesNoYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-84636\n        Wi-Fi Connectivity\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43674\n        Wi-Fi3\n        An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n    \n    \n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-09-16T22:01:34.169270Z"}, {"uuid": "8885b39a-1d34-4485-bd70-75f32109130d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28899", "type": "seen", "source": "https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026", "content": "Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.\nFor the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn\u2019t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.\nCVE-2026-65400 \u2014 Screen Sharing Server (9.8 CRITICAL, \u26a0 CISA KEV).  This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.\nCVE-2026-65414 \u2014 Bluetooth (9.8 CRITICAL). This is the highest-scored non-exploited bug in the release. It\u2019s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it \"automatable: yes, technical impact: total.\" It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.\nCVE-2026-65346 \u2014 ImageIO (8.8 HIGH).  The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.\nTwo honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) \u2014 a sandbox-to-kernel arbitrary-code-execution bug \u2014 and CVE-2026-43790 (Kernel) \u2014 remote kernel memory corruption \u2014 are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\nApple Security Updates \u2014 September 14, 2026 (v27)\n\n\n    \n      273Total CVEs\n      134Scored\n      139TBD\n      2CRITICAL\n      46HIGH\n      84MEDIUM\n      2LOW\n    \n    \nCVSS is the NVD primary score where available, otherwise CISA-ADP secondary; TBD = NVD has not scored it yet (most v27 CVEs are still under analysis). \u26a0 KEV marks CVEs in CISA's Known Exploited Vulnerabilities catalog.\n    \n    \n\n      Apple security release — September 14, 2026 (version 27), 273 CVEs. CVSS/Severity from NVD (National Vulnerability Database) as of Sept 16, 2026. CVE IDs link to NVD. \"Yes/No\" indicates whether each update is affected.\n      \n          CVE IDComponentImpactCVSSSeverity\n          iOS / iPadOS 27\n          iOS / iPadOS 26.7\n          macOS 27 (Golden Gate)\n          macOS Tahoe 26.7\n          macOS Sequoia 15.8\n          tvOS 27\n          watchOS 27\n          visionOS 27\n          Safari 27\n          Xcode 27\n      \n      \n      \n        CVE-2026-65400\n        Screen Sharing Server\n        An attacker on the network may be able to authenticate to Screen Sharing without valid credentials\n        9.8\u26a0 KEV CRITICAL\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65414\n        Bluetooth\n        A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n        9.8CRITICAL\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43692\n        CUPS\n        A remote user may cause an unexpected app termination or arbitrary code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65346\n        ImageIO\n        Processing an image may lead to arbitrary code execution\n        8.8HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-43686\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        8.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65374\n        WebDAV\n        Connecting to a malicious WebDAV server may result in code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43794\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65390\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65391\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        8.6HIGH\n        NoNoNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84581\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        8.4HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84535\n        Automator\n        An app may be able to break out of its sandbox\n        8.2HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84516\n        CUPS\n        Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory\n        8.1HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65415\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        8.1HIGH\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84568\n        autofs\n        An attacker with control of a network directory server may be able to execute arbitrary code with root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84607\n        AVEVideoEncoder\n        A sandboxed app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84631\n        Bluetooth\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43786\n        CoreServices\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84575\n        CoreUI\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43691\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84505\n        Directory Utility\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65362\n        Disk Images\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        NoYesNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43684\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.8HIGH\n        NoYesYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43689\n        Kernel\n        A malicious app may be able to gain root privileges\n        7.8HIGH\n        YesYesYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86917\n        Kernel\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64712\n        odproxyd\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84515\n        SMB\n        Connecting to a malicious SMB server may lead to kernel memory corruption\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84506\n        udf\n        An app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64761\n        Accessibility\n        An app may be able to identify what other apps a user has installed\n        7.5HIGH\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86895\n        CloudKit\n        A local app may be able to read a persistent account identifier\n        7.5HIGH\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84563\n        CUPS\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84606\n        iCloud\n        An app may be able to identify a user across reinstalls\n        7.5HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        7.5HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28969\n        IOKit\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65343\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65364\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86894\n        libxpc\n        An app may be able to break out of its sandbox\n        7.5HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84543\n        SMB\n        Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84553\n        smbx\n        A remote attacker may be able to cause a denial-of-service\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28930\n        Spotlight\n        An app may be able to access protected user data\n        7.5HIGH\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-86904\n        Watch App\n        An app may be able to track users across apps and websites without permission\n        7.5HIGH\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-64752\n        CoreMedia\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        7.3HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84611\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84632\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64736\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.1HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-65349\n        Kernel\n        An app may be able to cause unexpected system termination or read kernel memory\n        6.6MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84537\n        SMB\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.6MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43788\n        Spotlight\n        Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n        6.6MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86882\n        Accelerate Framework\n        Processing a maliciously crafted image may lead to unexpected process termination\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84519\n        AppleDouble\n        Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n        6.5MEDIUM\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86879\n        Baseband\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86885\n        Baseband\n        An attacker in radio range may be able to cause unexpected system termination\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65412\n        CoreText\n        Processing web content may lead to a denial-of-service\n        6.5MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-84596\n        CoreText\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84597\n        FontParser\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2022-3437\n        Heimdal\n        A user in a privileged network position may be able to leak sensitive user information\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28934\n        HFS\n        Mounting a malicious disk image may cause unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65347\n        ImageIO\n        Processing an image may lead to a denial-of-service\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65395\n        ImageIO\n        Processing a maliciously crafted image may result in memory corruption\n        6.5MEDIUM\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43687\n        Kernel\n        Connecting to a malicious NFS server may disclose kernel memory\n        6.5MEDIUM\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-65330\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84538\n        Kernel\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84588\n        Kernel\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84487\n        SceneKit\n        Processing a maliciously crafted file may result in disclosure of process memory\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43719\n        SMB\n        Mounting a maliciously crafted SMB network share may lead to system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65365\n        SMB\n        Connecting to a malicious SMB share may disclose kernel memory\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84536\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43677\n        WebDAV\n        Connecting to a malicious WebDAV server may lead to unexpected app termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64715\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64753\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-64787\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64778\n        WebKit History\n        Visiting a maliciously crafted website may leak sensitive data\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84560\n        Bluetooth\n        An app may gain unauthorized access to Bluetooth\n        6.1MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84619\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        6.1MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84554\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.9MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43664\n        Accessibility\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-65404\n        Accounts\n        A malicious application may be able to bypass Privacy preferences\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84523\n        APFS\n        An app may be able to cause unexpected system termination or write kernel memory\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84586\n        Apple Account\n        A malicious application may be able to leak sensitive user information\n        5.5MEDIUM\n        NoNoYesNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65407\n        AppleAVD\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84593\n        AppleKeyStore\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        5.5MEDIUM\n        NoNoNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86905\n        Authentication Services\n        An app may be able to delete credentials stored in Keychain\n        5.5MEDIUM\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43737\n        CoreMotion\n        An app may be able to access motion data from headphones without user consent\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84489\n        CoreUI\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84534\n        file_cmds\n        Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-65409\n        Foundation\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64756\n        Image Capture\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        YesNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64760\n        IOSurfaceAccelerator\n        An app may be able to leak sensitive kernel state\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65401\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65402\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65405\n        Kernel\n        An app may be able to determine kernel memory layout\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84517\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84521\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-86903\n        Kernel\n        An app may be able to disclose kernel memory\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86883\n        Managed Configuration\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43741\n        Messages\n        An app may be able to access protected user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84491\n        Photos Storage\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84576\n        QuartzCore\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84555\n        Sandbox\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65413\n        SceneKit\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28937\n        Terminal\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        5.5MEDIUM\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65393\n        Xcode IDE\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoYes\n      \n      \n        CVE-2026-84617\n        XPC\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64788\n        IOGPUFamily\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-65341\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-34979\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.3MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86876\n        CoreMedia\n        A sandboxed process may be able to circumvent sandbox restrictions\n        5.2MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86889\n        Security\n        An attacker in a privileged network position may be able to intercept network traffic\n        4.8MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84492\n        Graphics\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84630\n        Kernel\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43690\n        SMB\n        A local user may be able to read kernel memory\n        4.7MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84518\n        Safari\n        A malicious website may be able to determine what apps a user has installed\n        4.3MEDIUM\n        YesNoYesNoNoNoNoNoYesNo\n      \n      \n        CVE-2026-43795\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64780\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64781\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64784\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65331\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65332\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65333\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65334\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65335\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65336\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65337\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65338\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65340\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65351\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64782\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64779\n        WebKit Storage\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86910\n        APFS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86888\n        App Store\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesNoYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84587\n        AppKit\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-20683\n        Apple Account\n        An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n        TBDTBD\n        YesNoYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84601\n        Apple Intelligence\n        An app may be able to bypass Apple Intelligence security prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65408\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84520\n        AppleFDEKeyStore\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65381\n        AppleMobileFileIntegrity\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84522\n        Archive Utility\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84584\n        Archive Utility\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65342\n        ATS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84525\n        ATS\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65339\n        Audio\n        An app may be able to leak sensitive user information\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84583\n        AuthKit\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84570\n        autofs\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65410\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84616\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65406\n        BackgroundAssets\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-86878\n        Camera\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84567\n        cd9660\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86893\n        CloudKit\n        An app may be able to read device name\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65399\n        copyfile\n        An archive may be able to bypass Gatekeeper\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86891\n        Core Bluetooth\n        An app may be able to access Bluetooth device information\n        TBDTBD\n        NoNoYesYesYesNoYesNoNoNo\n      \n      \n        CVE-2026-43683\n        CoreDrag\n        An app may be able to cause unexpected process termination or disclose process memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43789\n        CoreMedia\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65344\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43702\n        CoreMedia Video Toolbox\n        Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n        TBDTBD\n        NoYesNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84624\n        CoreML\n        A sandboxed app may be able to access restricted files\n        TBDTBD\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84559\n        CoreServices\n        A malicious application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84574\n        CoreServices\n        An app may be able to bypass Privacy preferences\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84511\n        CoreUI\n        Processing a maliciously crafted asset catalog may lead to unexpected process termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84571\n        CoreUI\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64790\n        CUPS\n        An app may be able to gain elevated privileges\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84540\n        CUPS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84541\n        CUPS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84612\n        DeviceCheck\n        An app may be able to read persistent device identifiers\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84512\n        Disk Images\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84550\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84552\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84565\n        Disk Images\n        Processing a maliciously crafted disk image may lead to unexpected app termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84510\n        exFAT\n        Mounting a maliciously crafted volume may lead to unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86900\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86901\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43785\n        File Bookmark\n        An app may be able to modify a file it only had permission to read\n        TBDTBD\n        YesNoYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43688\n        Filters\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84524\n        FontParser\n        Processing a maliciously crafted font file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84569\n        Foundation\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86911\n        Foundation\n        A malicious app may be able to bypass clickjacking protections for secure prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84618\n        Game Center\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84533\n        Heimdal\n        An attacker in a privileged network position may be able to modify network traffic\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-64714\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84564\n        ImageIO\n        Processing a maliciously crafted image may result in disclosure of process memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86869\n        ImageIO\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        NoYesYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoYesNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65398\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65354\n        iWork\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28935\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-28968\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43790\n        Kernel\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65358\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65359\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65360\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65369\n        Kernel\n        A malicious application may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65371\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65377\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84507\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84530\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84544\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84549\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84558\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84561\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84566\n        Kernel\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84602\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84622\n        Kernel\n        An app with root privileges may be able to read uninitialized kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84514\n        Kext Management\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84556\n        Keychain Access\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65382\n        LaunchServices\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86870\n        libarchive\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84577\n        libxpc\n        An app may be able to bypass sandbox restrictions\n        TBDTBD\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43787\n        Mail\n        An attacker in a privileged network position may be able to leak sensitive user information\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84573\n        Mail\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84628\n        MediaRemote\n        A sandboxed app may be able to access the System Keychain\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86924\n        MobileAccessoryUpdater\n        Connecting a malicious accessory may cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65411\n        MobileBackup\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84598\n        MobileBackup\n        An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84497\n        Model I/O\n        Opening a maliciously crafted file may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84615\n        Music\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesNoNoNoYesNoYesNoNo\n      \n      \n        CVE-2026-43695\n        NetworkExtension\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84585\n        NetworkExtension\n        An app may be able to access local network devices without user consent\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84626\n        NetworkExtension\n        An app may be able to identify what other apps a user has installed\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86902\n        NSDocument\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84629\n        Photos Storage\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84623\n        Power Management\n        An app may be able to fingerprint the device\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84578\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84580\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84548\n        Quick Look\n        Processing a maliciously crafted document may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28966\n        RealityKit\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84532\n        RealityKit\n        Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-65403\n        Reminders\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86897\n        Safe Browsing\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65380\n        Sandbox\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84551\n        Sandbox\n        An app may be able to bypass network restrictions\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84603\n        Sandbox Profiles\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84625\n        Sandbox Profiles\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43697\n        SceneKit\n        Processing a maliciously crafted 3D file may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84526\n        SceneKit\n        Processing a maliciously crafted 3D scene may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84546\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84620\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84531\n        Security\n        Processing maliciously crafted NTLM input may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86881\n        Security\n        An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84600\n        Shortcuts\n        A malicious shortcut may be able to send messages without user confirmation\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86884\n        Siri\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-86890\n        Siri Suggestions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65376\n        SMB\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84509\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84609\n        Software Update\n        An app may be able to modify protected system files\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65361\n        SoftwareUpdate\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65378\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84621\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86892\n        SpringBoard\n        An app may be able to cause a denial-of-service\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65345\n        Storage\n        An app may be able to access user-sensitive data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65348\n        Storage\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43791\n        StorageKit\n        An app may be able to read arbitrary files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84513\n        Symptom Framework\n        A malicious application may be able to determine a user's current location\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65383\n        System Settings\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86909\n        System Settings\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84527\n        TCC\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84589\n        TCC\n        An app may be able to modify Privacy preferences\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86886\n        TCC\n        An app may be able to modify protected system files\n        TBDTBD\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65329\n        Telephony\n        An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86887\n        Time Zone\n        An app may be able to bypass certain Privacy preferences\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43696\n        Touch Bar\n        An app may be able to capture Touch Bar content without authorization\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84572\n        udf\n        An app may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28899\n        WebDAV\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65375\n        WebDAV\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-84635\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-86898\n        WebKit\n        Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n        TBDTBD\n        YesNoYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-84636\n        Wi-Fi Connectivity\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43674\n        Wi-Fi3\n        An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n    \n    \n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-09-16T22:01:54.272608Z"}, {"uuid": "5a43960e-a930-4704-82b2-b1ec4dedfb98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28966", "type": "seen", "source": "https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026", "content": "Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.\nFor the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn\u2019t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.\nCVE-2026-65400 \u2014 Screen Sharing Server (9.8 CRITICAL, \u26a0 CISA KEV).  This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.\nCVE-2026-65414 \u2014 Bluetooth (9.8 CRITICAL). This is the highest-scored non-exploited bug in the release. It\u2019s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it \"automatable: yes, technical impact: total.\" It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.\nCVE-2026-65346 \u2014 ImageIO (8.8 HIGH).  The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.\nTwo honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) \u2014 a sandbox-to-kernel arbitrary-code-execution bug \u2014 and CVE-2026-43790 (Kernel) \u2014 remote kernel memory corruption \u2014 are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\nApple Security Updates \u2014 September 14, 2026 (v27)\n\n\n    \n      273Total CVEs\n      134Scored\n      139TBD\n      2CRITICAL\n      46HIGH\n      84MEDIUM\n      2LOW\n    \n    \nCVSS is the NVD primary score where available, otherwise CISA-ADP secondary; TBD = NVD has not scored it yet (most v27 CVEs are still under analysis). \u26a0 KEV marks CVEs in CISA's Known Exploited Vulnerabilities catalog.\n    \n    \n\n      Apple security release — September 14, 2026 (version 27), 273 CVEs. CVSS/Severity from NVD (National Vulnerability Database) as of Sept 16, 2026. CVE IDs link to NVD. \"Yes/No\" indicates whether each update is affected.\n      \n          CVE IDComponentImpactCVSSSeverity\n          iOS / iPadOS 27\n          iOS / iPadOS 26.7\n          macOS 27 (Golden Gate)\n          macOS Tahoe 26.7\n          macOS Sequoia 15.8\n          tvOS 27\n          watchOS 27\n          visionOS 27\n          Safari 27\n          Xcode 27\n      \n      \n      \n        CVE-2026-65400\n        Screen Sharing Server\n        An attacker on the network may be able to authenticate to Screen Sharing without valid credentials\n        9.8\u26a0 KEV CRITICAL\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65414\n        Bluetooth\n        A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n        9.8CRITICAL\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43692\n        CUPS\n        A remote user may cause an unexpected app termination or arbitrary code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65346\n        ImageIO\n        Processing an image may lead to arbitrary code execution\n        8.8HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-43686\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        8.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65374\n        WebDAV\n        Connecting to a malicious WebDAV server may result in code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43794\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65390\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65391\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        8.6HIGH\n        NoNoNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84581\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        8.4HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84535\n        Automator\n        An app may be able to break out of its sandbox\n        8.2HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84516\n        CUPS\n        Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory\n        8.1HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65415\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        8.1HIGH\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84568\n        autofs\n        An attacker with control of a network directory server may be able to execute arbitrary code with root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84607\n        AVEVideoEncoder\n        A sandboxed app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84631\n        Bluetooth\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43786\n        CoreServices\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84575\n        CoreUI\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43691\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84505\n        Directory Utility\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65362\n        Disk Images\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        NoYesNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43684\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.8HIGH\n        NoYesYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43689\n        Kernel\n        A malicious app may be able to gain root privileges\n        7.8HIGH\n        YesYesYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86917\n        Kernel\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64712\n        odproxyd\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84515\n        SMB\n        Connecting to a malicious SMB server may lead to kernel memory corruption\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84506\n        udf\n        An app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64761\n        Accessibility\n        An app may be able to identify what other apps a user has installed\n        7.5HIGH\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86895\n        CloudKit\n        A local app may be able to read a persistent account identifier\n        7.5HIGH\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84563\n        CUPS\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84606\n        iCloud\n        An app may be able to identify a user across reinstalls\n        7.5HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        7.5HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28969\n        IOKit\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65343\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65364\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86894\n        libxpc\n        An app may be able to break out of its sandbox\n        7.5HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84543\n        SMB\n        Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84553\n        smbx\n        A remote attacker may be able to cause a denial-of-service\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28930\n        Spotlight\n        An app may be able to access protected user data\n        7.5HIGH\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-86904\n        Watch App\n        An app may be able to track users across apps and websites without permission\n        7.5HIGH\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-64752\n        CoreMedia\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        7.3HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84611\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84632\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64736\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.1HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-65349\n        Kernel\n        An app may be able to cause unexpected system termination or read kernel memory\n        6.6MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84537\n        SMB\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.6MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43788\n        Spotlight\n        Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n        6.6MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86882\n        Accelerate Framework\n        Processing a maliciously crafted image may lead to unexpected process termination\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84519\n        AppleDouble\n        Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n        6.5MEDIUM\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86879\n        Baseband\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86885\n        Baseband\n        An attacker in radio range may be able to cause unexpected system termination\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65412\n        CoreText\n        Processing web content may lead to a denial-of-service\n        6.5MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-84596\n        CoreText\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84597\n        FontParser\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2022-3437\n        Heimdal\n        A user in a privileged network position may be able to leak sensitive user information\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28934\n        HFS\n        Mounting a malicious disk image may cause unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65347\n        ImageIO\n        Processing an image may lead to a denial-of-service\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65395\n        ImageIO\n        Processing a maliciously crafted image may result in memory corruption\n        6.5MEDIUM\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43687\n        Kernel\n        Connecting to a malicious NFS server may disclose kernel memory\n        6.5MEDIUM\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-65330\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84538\n        Kernel\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84588\n        Kernel\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84487\n        SceneKit\n        Processing a maliciously crafted file may result in disclosure of process memory\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43719\n        SMB\n        Mounting a maliciously crafted SMB network share may lead to system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65365\n        SMB\n        Connecting to a malicious SMB share may disclose kernel memory\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84536\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43677\n        WebDAV\n        Connecting to a malicious WebDAV server may lead to unexpected app termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64715\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64753\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-64787\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64778\n        WebKit History\n        Visiting a maliciously crafted website may leak sensitive data\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84560\n        Bluetooth\n        An app may gain unauthorized access to Bluetooth\n        6.1MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84619\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        6.1MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84554\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.9MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43664\n        Accessibility\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-65404\n        Accounts\n        A malicious application may be able to bypass Privacy preferences\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84523\n        APFS\n        An app may be able to cause unexpected system termination or write kernel memory\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84586\n        Apple Account\n        A malicious application may be able to leak sensitive user information\n        5.5MEDIUM\n        NoNoYesNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65407\n        AppleAVD\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84593\n        AppleKeyStore\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        5.5MEDIUM\n        NoNoNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86905\n        Authentication Services\n        An app may be able to delete credentials stored in Keychain\n        5.5MEDIUM\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43737\n        CoreMotion\n        An app may be able to access motion data from headphones without user consent\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84489\n        CoreUI\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84534\n        file_cmds\n        Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-65409\n        Foundation\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64756\n        Image Capture\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        YesNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64760\n        IOSurfaceAccelerator\n        An app may be able to leak sensitive kernel state\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65401\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65402\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65405\n        Kernel\n        An app may be able to determine kernel memory layout\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84517\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84521\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-86903\n        Kernel\n        An app may be able to disclose kernel memory\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86883\n        Managed Configuration\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43741\n        Messages\n        An app may be able to access protected user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84491\n        Photos Storage\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84576\n        QuartzCore\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84555\n        Sandbox\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65413\n        SceneKit\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28937\n        Terminal\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        5.5MEDIUM\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65393\n        Xcode IDE\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoYes\n      \n      \n        CVE-2026-84617\n        XPC\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64788\n        IOGPUFamily\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-65341\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-34979\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.3MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86876\n        CoreMedia\n        A sandboxed process may be able to circumvent sandbox restrictions\n        5.2MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86889\n        Security\n        An attacker in a privileged network position may be able to intercept network traffic\n        4.8MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84492\n        Graphics\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84630\n        Kernel\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43690\n        SMB\n        A local user may be able to read kernel memory\n        4.7MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84518\n        Safari\n        A malicious website may be able to determine what apps a user has installed\n        4.3MEDIUM\n        YesNoYesNoNoNoNoNoYesNo\n      \n      \n        CVE-2026-43795\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64780\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64781\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64784\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65331\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65332\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65333\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65334\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65335\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65336\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65337\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65338\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65340\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65351\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64782\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64779\n        WebKit Storage\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86910\n        APFS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86888\n        App Store\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesNoYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84587\n        AppKit\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-20683\n        Apple Account\n        An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n        TBDTBD\n        YesNoYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84601\n        Apple Intelligence\n        An app may be able to bypass Apple Intelligence security prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65408\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84520\n        AppleFDEKeyStore\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65381\n        AppleMobileFileIntegrity\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84522\n        Archive Utility\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84584\n        Archive Utility\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65342\n        ATS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84525\n        ATS\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65339\n        Audio\n        An app may be able to leak sensitive user information\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84583\n        AuthKit\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84570\n        autofs\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65410\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84616\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65406\n        BackgroundAssets\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-86878\n        Camera\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84567\n        cd9660\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86893\n        CloudKit\n        An app may be able to read device name\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65399\n        copyfile\n        An archive may be able to bypass Gatekeeper\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86891\n        Core Bluetooth\n        An app may be able to access Bluetooth device information\n        TBDTBD\n        NoNoYesYesYesNoYesNoNoNo\n      \n      \n        CVE-2026-43683\n        CoreDrag\n        An app may be able to cause unexpected process termination or disclose process memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43789\n        CoreMedia\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65344\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43702\n        CoreMedia Video Toolbox\n        Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n        TBDTBD\n        NoYesNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84624\n        CoreML\n        A sandboxed app may be able to access restricted files\n        TBDTBD\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84559\n        CoreServices\n        A malicious application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84574\n        CoreServices\n        An app may be able to bypass Privacy preferences\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84511\n        CoreUI\n        Processing a maliciously crafted asset catalog may lead to unexpected process termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84571\n        CoreUI\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64790\n        CUPS\n        An app may be able to gain elevated privileges\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84540\n        CUPS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84541\n        CUPS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84612\n        DeviceCheck\n        An app may be able to read persistent device identifiers\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84512\n        Disk Images\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84550\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84552\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84565\n        Disk Images\n        Processing a maliciously crafted disk image may lead to unexpected app termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84510\n        exFAT\n        Mounting a maliciously crafted volume may lead to unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86900\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86901\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43785\n        File Bookmark\n        An app may be able to modify a file it only had permission to read\n        TBDTBD\n        YesNoYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43688\n        Filters\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84524\n        FontParser\n        Processing a maliciously crafted font file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84569\n        Foundation\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86911\n        Foundation\n        A malicious app may be able to bypass clickjacking protections for secure prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84618\n        Game Center\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84533\n        Heimdal\n        An attacker in a privileged network position may be able to modify network traffic\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-64714\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84564\n        ImageIO\n        Processing a maliciously crafted image may result in disclosure of process memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86869\n        ImageIO\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        NoYesYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoYesNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65398\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65354\n        iWork\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28935\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-28968\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43790\n        Kernel\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65358\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65359\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65360\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65369\n        Kernel\n        A malicious application may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65371\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65377\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84507\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84530\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84544\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84549\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84558\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84561\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84566\n        Kernel\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84602\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84622\n        Kernel\n        An app with root privileges may be able to read uninitialized kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84514\n        Kext Management\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84556\n        Keychain Access\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65382\n        LaunchServices\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86870\n        libarchive\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84577\n        libxpc\n        An app may be able to bypass sandbox restrictions\n        TBDTBD\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43787\n        Mail\n        An attacker in a privileged network position may be able to leak sensitive user information\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84573\n        Mail\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84628\n        MediaRemote\n        A sandboxed app may be able to access the System Keychain\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86924\n        MobileAccessoryUpdater\n        Connecting a malicious accessory may cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65411\n        MobileBackup\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84598\n        MobileBackup\n        An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84497\n        Model I/O\n        Opening a maliciously crafted file may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84615\n        Music\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesNoNoNoYesNoYesNoNo\n      \n      \n        CVE-2026-43695\n        NetworkExtension\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84585\n        NetworkExtension\n        An app may be able to access local network devices without user consent\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84626\n        NetworkExtension\n        An app may be able to identify what other apps a user has installed\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86902\n        NSDocument\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84629\n        Photos Storage\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84623\n        Power Management\n        An app may be able to fingerprint the device\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84578\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84580\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84548\n        Quick Look\n        Processing a maliciously crafted document may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28966\n        RealityKit\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84532\n        RealityKit\n        Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-65403\n        Reminders\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86897\n        Safe Browsing\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65380\n        Sandbox\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84551\n        Sandbox\n        An app may be able to bypass network restrictions\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84603\n        Sandbox Profiles\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84625\n        Sandbox Profiles\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43697\n        SceneKit\n        Processing a maliciously crafted 3D file may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84526\n        SceneKit\n        Processing a maliciously crafted 3D scene may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84546\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84620\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84531\n        Security\n        Processing maliciously crafted NTLM input may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86881\n        Security\n        An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84600\n        Shortcuts\n        A malicious shortcut may be able to send messages without user confirmation\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86884\n        Siri\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-86890\n        Siri Suggestions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65376\n        SMB\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84509\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84609\n        Software Update\n        An app may be able to modify protected system files\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65361\n        SoftwareUpdate\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65378\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84621\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86892\n        SpringBoard\n        An app may be able to cause a denial-of-service\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65345\n        Storage\n        An app may be able to access user-sensitive data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65348\n        Storage\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43791\n        StorageKit\n        An app may be able to read arbitrary files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84513\n        Symptom Framework\n        A malicious application may be able to determine a user's current location\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65383\n        System Settings\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86909\n        System Settings\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84527\n        TCC\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84589\n        TCC\n        An app may be able to modify Privacy preferences\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86886\n        TCC\n        An app may be able to modify protected system files\n        TBDTBD\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65329\n        Telephony\n        An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86887\n        Time Zone\n        An app may be able to bypass certain Privacy preferences\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43696\n        Touch Bar\n        An app may be able to capture Touch Bar content without authorization\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84572\n        udf\n        An app may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28899\n        WebDAV\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65375\n        WebDAV\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-84635\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-86898\n        WebKit\n        Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n        TBDTBD\n        YesNoYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-84636\n        Wi-Fi Connectivity\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43674\n        Wi-Fi3\n        An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n    \n    \n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-09-17T01:01:35.451421Z"}, {"uuid": "ed5e3fd7-ac16-4b1f-9422-83ea195271b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28968", "type": "seen", "source": "https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026", "content": "Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.\nFor the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn\u2019t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.\nCVE-2026-65400 \u2014 Screen Sharing Server (9.8 CRITICAL, \u26a0 CISA KEV).  This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.\nCVE-2026-65414 \u2014 Bluetooth (9.8 CRITICAL). This is the highest-scored non-exploited bug in the release. It\u2019s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it \"automatable: yes, technical impact: total.\" It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.\nCVE-2026-65346 \u2014 ImageIO (8.8 HIGH).  The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.\nTwo honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) \u2014 a sandbox-to-kernel arbitrary-code-execution bug \u2014 and CVE-2026-43790 (Kernel) \u2014 remote kernel memory corruption \u2014 are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\nApple Security Updates \u2014 September 14, 2026 (v27)\n\n\n    \n      273Total CVEs\n      134Scored\n      139TBD\n      2CRITICAL\n      46HIGH\n      84MEDIUM\n      2LOW\n    \n    \nCVSS is the NVD primary score where available, otherwise CISA-ADP secondary; TBD = NVD has not scored it yet (most v27 CVEs are still under analysis). \u26a0 KEV marks CVEs in CISA's Known Exploited Vulnerabilities catalog.\n    \n    \n\n      Apple security release — September 14, 2026 (version 27), 273 CVEs. CVSS/Severity from NVD (National Vulnerability Database) as of Sept 16, 2026. CVE IDs link to NVD. \"Yes/No\" indicates whether each update is affected.\n      \n          CVE IDComponentImpactCVSSSeverity\n          iOS / iPadOS 27\n          iOS / iPadOS 26.7\n          macOS 27 (Golden Gate)\n          macOS Tahoe 26.7\n          macOS Sequoia 15.8\n          tvOS 27\n          watchOS 27\n          visionOS 27\n          Safari 27\n          Xcode 27\n      \n      \n      \n        CVE-2026-65400\n        Screen Sharing Server\n        An attacker on the network may be able to authenticate to Screen Sharing without valid credentials\n        9.8\u26a0 KEV CRITICAL\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65414\n        Bluetooth\n        A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n        9.8CRITICAL\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43692\n        CUPS\n        A remote user may cause an unexpected app termination or arbitrary code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65346\n        ImageIO\n        Processing an image may lead to arbitrary code execution\n        8.8HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-43686\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        8.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65374\n        WebDAV\n        Connecting to a malicious WebDAV server may result in code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43794\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65390\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65391\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        8.6HIGH\n        NoNoNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84581\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        8.4HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84535\n        Automator\n        An app may be able to break out of its sandbox\n        8.2HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84516\n        CUPS\n        Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory\n        8.1HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65415\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        8.1HIGH\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84568\n        autofs\n        An attacker with control of a network directory server may be able to execute arbitrary code with root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84607\n        AVEVideoEncoder\n        A sandboxed app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84631\n        Bluetooth\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43786\n        CoreServices\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84575\n        CoreUI\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43691\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84505\n        Directory Utility\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65362\n        Disk Images\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        NoYesNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43684\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.8HIGH\n        NoYesYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43689\n        Kernel\n        A malicious app may be able to gain root privileges\n        7.8HIGH\n        YesYesYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86917\n        Kernel\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64712\n        odproxyd\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84515\n        SMB\n        Connecting to a malicious SMB server may lead to kernel memory corruption\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84506\n        udf\n        An app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64761\n        Accessibility\n        An app may be able to identify what other apps a user has installed\n        7.5HIGH\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86895\n        CloudKit\n        A local app may be able to read a persistent account identifier\n        7.5HIGH\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84563\n        CUPS\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84606\n        iCloud\n        An app may be able to identify a user across reinstalls\n        7.5HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        7.5HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28969\n        IOKit\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65343\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65364\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86894\n        libxpc\n        An app may be able to break out of its sandbox\n        7.5HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84543\n        SMB\n        Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84553\n        smbx\n        A remote attacker may be able to cause a denial-of-service\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28930\n        Spotlight\n        An app may be able to access protected user data\n        7.5HIGH\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-86904\n        Watch App\n        An app may be able to track users across apps and websites without permission\n        7.5HIGH\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-64752\n        CoreMedia\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        7.3HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84611\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84632\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64736\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.1HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-65349\n        Kernel\n        An app may be able to cause unexpected system termination or read kernel memory\n        6.6MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84537\n        SMB\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.6MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43788\n        Spotlight\n        Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n        6.6MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86882\n        Accelerate Framework\n        Processing a maliciously crafted image may lead to unexpected process termination\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84519\n        AppleDouble\n        Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n        6.5MEDIUM\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86879\n        Baseband\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86885\n        Baseband\n        An attacker in radio range may be able to cause unexpected system termination\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65412\n        CoreText\n        Processing web content may lead to a denial-of-service\n        6.5MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-84596\n        CoreText\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84597\n        FontParser\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2022-3437\n        Heimdal\n        A user in a privileged network position may be able to leak sensitive user information\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28934\n        HFS\n        Mounting a malicious disk image may cause unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65347\n        ImageIO\n        Processing an image may lead to a denial-of-service\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65395\n        ImageIO\n        Processing a maliciously crafted image may result in memory corruption\n        6.5MEDIUM\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43687\n        Kernel\n        Connecting to a malicious NFS server may disclose kernel memory\n        6.5MEDIUM\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-65330\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84538\n        Kernel\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84588\n        Kernel\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84487\n        SceneKit\n        Processing a maliciously crafted file may result in disclosure of process memory\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43719\n        SMB\n        Mounting a maliciously crafted SMB network share may lead to system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65365\n        SMB\n        Connecting to a malicious SMB share may disclose kernel memory\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84536\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43677\n        WebDAV\n        Connecting to a malicious WebDAV server may lead to unexpected app termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64715\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64753\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-64787\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64778\n        WebKit History\n        Visiting a maliciously crafted website may leak sensitive data\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84560\n        Bluetooth\n        An app may gain unauthorized access to Bluetooth\n        6.1MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84619\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        6.1MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84554\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.9MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43664\n        Accessibility\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-65404\n        Accounts\n        A malicious application may be able to bypass Privacy preferences\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84523\n        APFS\n        An app may be able to cause unexpected system termination or write kernel memory\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84586\n        Apple Account\n        A malicious application may be able to leak sensitive user information\n        5.5MEDIUM\n        NoNoYesNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65407\n        AppleAVD\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84593\n        AppleKeyStore\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        5.5MEDIUM\n        NoNoNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86905\n        Authentication Services\n        An app may be able to delete credentials stored in Keychain\n        5.5MEDIUM\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43737\n        CoreMotion\n        An app may be able to access motion data from headphones without user consent\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84489\n        CoreUI\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84534\n        file_cmds\n        Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-65409\n        Foundation\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64756\n        Image Capture\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        YesNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64760\n        IOSurfaceAccelerator\n        An app may be able to leak sensitive kernel state\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65401\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65402\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65405\n        Kernel\n        An app may be able to determine kernel memory layout\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84517\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84521\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-86903\n        Kernel\n        An app may be able to disclose kernel memory\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86883\n        Managed Configuration\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43741\n        Messages\n        An app may be able to access protected user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84491\n        Photos Storage\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84576\n        QuartzCore\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84555\n        Sandbox\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65413\n        SceneKit\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28937\n        Terminal\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        5.5MEDIUM\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65393\n        Xcode IDE\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoYes\n      \n      \n        CVE-2026-84617\n        XPC\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64788\n        IOGPUFamily\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-65341\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-34979\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.3MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86876\n        CoreMedia\n        A sandboxed process may be able to circumvent sandbox restrictions\n        5.2MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86889\n        Security\n        An attacker in a privileged network position may be able to intercept network traffic\n        4.8MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84492\n        Graphics\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84630\n        Kernel\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43690\n        SMB\n        A local user may be able to read kernel memory\n        4.7MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84518\n        Safari\n        A malicious website may be able to determine what apps a user has installed\n        4.3MEDIUM\n        YesNoYesNoNoNoNoNoYesNo\n      \n      \n        CVE-2026-43795\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64780\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64781\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64784\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65331\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65332\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65333\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65334\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65335\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65336\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65337\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65338\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65340\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65351\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64782\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64779\n        WebKit Storage\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86910\n        APFS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86888\n        App Store\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesNoYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84587\n        AppKit\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-20683\n        Apple Account\n        An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n        TBDTBD\n        YesNoYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84601\n        Apple Intelligence\n        An app may be able to bypass Apple Intelligence security prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65408\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84520\n        AppleFDEKeyStore\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65381\n        AppleMobileFileIntegrity\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84522\n        Archive Utility\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84584\n        Archive Utility\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65342\n        ATS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84525\n        ATS\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65339\n        Audio\n        An app may be able to leak sensitive user information\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84583\n        AuthKit\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84570\n        autofs\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65410\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84616\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65406\n        BackgroundAssets\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-86878\n        Camera\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84567\n        cd9660\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86893\n        CloudKit\n        An app may be able to read device name\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65399\n        copyfile\n        An archive may be able to bypass Gatekeeper\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86891\n        Core Bluetooth\n        An app may be able to access Bluetooth device information\n        TBDTBD\n        NoNoYesYesYesNoYesNoNoNo\n      \n      \n        CVE-2026-43683\n        CoreDrag\n        An app may be able to cause unexpected process termination or disclose process memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43789\n        CoreMedia\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65344\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43702\n        CoreMedia Video Toolbox\n        Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n        TBDTBD\n        NoYesNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84624\n        CoreML\n        A sandboxed app may be able to access restricted files\n        TBDTBD\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84559\n        CoreServices\n        A malicious application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84574\n        CoreServices\n        An app may be able to bypass Privacy preferences\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84511\n        CoreUI\n        Processing a maliciously crafted asset catalog may lead to unexpected process termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84571\n        CoreUI\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64790\n        CUPS\n        An app may be able to gain elevated privileges\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84540\n        CUPS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84541\n        CUPS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84612\n        DeviceCheck\n        An app may be able to read persistent device identifiers\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84512\n        Disk Images\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84550\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84552\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84565\n        Disk Images\n        Processing a maliciously crafted disk image may lead to unexpected app termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84510\n        exFAT\n        Mounting a maliciously crafted volume may lead to unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86900\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86901\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43785\n        File Bookmark\n        An app may be able to modify a file it only had permission to read\n        TBDTBD\n        YesNoYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43688\n        Filters\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84524\n        FontParser\n        Processing a maliciously crafted font file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84569\n        Foundation\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86911\n        Foundation\n        A malicious app may be able to bypass clickjacking protections for secure prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84618\n        Game Center\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84533\n        Heimdal\n        An attacker in a privileged network position may be able to modify network traffic\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-64714\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84564\n        ImageIO\n        Processing a maliciously crafted image may result in disclosure of process memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86869\n        ImageIO\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        NoYesYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoYesNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65398\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65354\n        iWork\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28935\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-28968\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43790\n        Kernel\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65358\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65359\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65360\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65369\n        Kernel\n        A malicious application may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65371\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65377\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84507\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84530\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84544\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84549\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84558\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84561\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84566\n        Kernel\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84602\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84622\n        Kernel\n        An app with root privileges may be able to read uninitialized kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84514\n        Kext Management\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84556\n        Keychain Access\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65382\n        LaunchServices\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86870\n        libarchive\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84577\n        libxpc\n        An app may be able to bypass sandbox restrictions\n        TBDTBD\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43787\n        Mail\n        An attacker in a privileged network position may be able to leak sensitive user information\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84573\n        Mail\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84628\n        MediaRemote\n        A sandboxed app may be able to access the System Keychain\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86924\n        MobileAccessoryUpdater\n        Connecting a malicious accessory may cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65411\n        MobileBackup\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84598\n        MobileBackup\n        An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84497\n        Model I/O\n        Opening a maliciously crafted file may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84615\n        Music\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesNoNoNoYesNoYesNoNo\n      \n      \n        CVE-2026-43695\n        NetworkExtension\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84585\n        NetworkExtension\n        An app may be able to access local network devices without user consent\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84626\n        NetworkExtension\n        An app may be able to identify what other apps a user has installed\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86902\n        NSDocument\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84629\n        Photos Storage\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84623\n        Power Management\n        An app may be able to fingerprint the device\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84578\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84580\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84548\n        Quick Look\n        Processing a maliciously crafted document may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28966\n        RealityKit\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84532\n        RealityKit\n        Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-65403\n        Reminders\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86897\n        Safe Browsing\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65380\n        Sandbox\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84551\n        Sandbox\n        An app may be able to bypass network restrictions\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84603\n        Sandbox Profiles\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84625\n        Sandbox Profiles\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43697\n        SceneKit\n        Processing a maliciously crafted 3D file may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84526\n        SceneKit\n        Processing a maliciously crafted 3D scene may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84546\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84620\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84531\n        Security\n        Processing maliciously crafted NTLM input may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86881\n        Security\n        An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84600\n        Shortcuts\n        A malicious shortcut may be able to send messages without user confirmation\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86884\n        Siri\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-86890\n        Siri Suggestions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65376\n        SMB\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84509\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84609\n        Software Update\n        An app may be able to modify protected system files\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65361\n        SoftwareUpdate\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65378\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84621\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86892\n        SpringBoard\n        An app may be able to cause a denial-of-service\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65345\n        Storage\n        An app may be able to access user-sensitive data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65348\n        Storage\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43791\n        StorageKit\n        An app may be able to read arbitrary files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84513\n        Symptom Framework\n        A malicious application may be able to determine a user's current location\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65383\n        System Settings\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86909\n        System Settings\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84527\n        TCC\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84589\n        TCC\n        An app may be able to modify Privacy preferences\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86886\n        TCC\n        An app may be able to modify protected system files\n        TBDTBD\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65329\n        Telephony\n        An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86887\n        Time Zone\n        An app may be able to bypass certain Privacy preferences\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43696\n        Touch Bar\n        An app may be able to capture Touch Bar content without authorization\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84572\n        udf\n        An app may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28899\n        WebDAV\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65375\n        WebDAV\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-84635\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-86898\n        WebKit\n        Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n        TBDTBD\n        YesNoYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-84636\n        Wi-Fi Connectivity\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43674\n        Wi-Fi3\n        An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n    \n    \n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-09-17T01:01:27.485260Z"}, {"uuid": "b1b41b16-551b-404c-8457-dd3e3613b54b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28937", "type": "seen", "source": "https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026", "content": "Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.\nFor the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn\u2019t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.\nCVE-2026-65400 \u2014 Screen Sharing Server (9.8 CRITICAL, \u26a0 CISA KEV).  This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.\nCVE-2026-65414 \u2014 Bluetooth (9.8 CRITICAL). This is the highest-scored non-exploited bug in the release. It\u2019s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it \"automatable: yes, technical impact: total.\" It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.\nCVE-2026-65346 \u2014 ImageIO (8.8 HIGH).  The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.\nTwo honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) \u2014 a sandbox-to-kernel arbitrary-code-execution bug \u2014 and CVE-2026-43790 (Kernel) \u2014 remote kernel memory corruption \u2014 are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\nApple Security Updates \u2014 September 14, 2026 (v27)\n\n\n    \n      273Total CVEs\n      134Scored\n      139TBD\n      2CRITICAL\n      46HIGH\n      84MEDIUM\n      2LOW\n    \n    \nCVSS is the NVD primary score where available, otherwise CISA-ADP secondary; TBD = NVD has not scored it yet (most v27 CVEs are still under analysis). \u26a0 KEV marks CVEs in CISA's Known Exploited Vulnerabilities catalog.\n    \n    \n\n      Apple security release — September 14, 2026 (version 27), 273 CVEs. CVSS/Severity from NVD (National Vulnerability Database) as of Sept 16, 2026. CVE IDs link to NVD. \"Yes/No\" indicates whether each update is affected.\n      \n          CVE IDComponentImpactCVSSSeverity\n          iOS / iPadOS 27\n          iOS / iPadOS 26.7\n          macOS 27 (Golden Gate)\n          macOS Tahoe 26.7\n          macOS Sequoia 15.8\n          tvOS 27\n          watchOS 27\n          visionOS 27\n          Safari 27\n          Xcode 27\n      \n      \n      \n        CVE-2026-65400\n        Screen Sharing Server\n        An attacker on the network may be able to authenticate to Screen Sharing without valid credentials\n        9.8\u26a0 KEV CRITICAL\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65414\n        Bluetooth\n        A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n        9.8CRITICAL\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43692\n        CUPS\n        A remote user may cause an unexpected app termination or arbitrary code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65346\n        ImageIO\n        Processing an image may lead to arbitrary code execution\n        8.8HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-43686\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        8.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65374\n        WebDAV\n        Connecting to a malicious WebDAV server may result in code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43794\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65390\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65391\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        8.6HIGH\n        NoNoNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84581\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        8.4HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84535\n        Automator\n        An app may be able to break out of its sandbox\n        8.2HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84516\n        CUPS\n        Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory\n        8.1HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65415\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        8.1HIGH\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84568\n        autofs\n        An attacker with control of a network directory server may be able to execute arbitrary code with root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84607\n        AVEVideoEncoder\n        A sandboxed app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84631\n        Bluetooth\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43786\n        CoreServices\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84575\n        CoreUI\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43691\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84505\n        Directory Utility\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65362\n        Disk Images\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        NoYesNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43684\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.8HIGH\n        NoYesYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43689\n        Kernel\n        A malicious app may be able to gain root privileges\n        7.8HIGH\n        YesYesYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86917\n        Kernel\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64712\n        odproxyd\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84515\n        SMB\n        Connecting to a malicious SMB server may lead to kernel memory corruption\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84506\n        udf\n        An app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64761\n        Accessibility\n        An app may be able to identify what other apps a user has installed\n        7.5HIGH\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86895\n        CloudKit\n        A local app may be able to read a persistent account identifier\n        7.5HIGH\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84563\n        CUPS\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84606\n        iCloud\n        An app may be able to identify a user across reinstalls\n        7.5HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        7.5HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28969\n        IOKit\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65343\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65364\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86894\n        libxpc\n        An app may be able to break out of its sandbox\n        7.5HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84543\n        SMB\n        Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84553\n        smbx\n        A remote attacker may be able to cause a denial-of-service\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28930\n        Spotlight\n        An app may be able to access protected user data\n        7.5HIGH\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-86904\n        Watch App\n        An app may be able to track users across apps and websites without permission\n        7.5HIGH\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-64752\n        CoreMedia\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        7.3HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84611\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84632\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64736\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.1HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-65349\n        Kernel\n        An app may be able to cause unexpected system termination or read kernel memory\n        6.6MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84537\n        SMB\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.6MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43788\n        Spotlight\n        Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n        6.6MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86882\n        Accelerate Framework\n        Processing a maliciously crafted image may lead to unexpected process termination\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84519\n        AppleDouble\n        Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n        6.5MEDIUM\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86879\n        Baseband\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86885\n        Baseband\n        An attacker in radio range may be able to cause unexpected system termination\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65412\n        CoreText\n        Processing web content may lead to a denial-of-service\n        6.5MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-84596\n        CoreText\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84597\n        FontParser\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2022-3437\n        Heimdal\n        A user in a privileged network position may be able to leak sensitive user information\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28934\n        HFS\n        Mounting a malicious disk image may cause unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65347\n        ImageIO\n        Processing an image may lead to a denial-of-service\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65395\n        ImageIO\n        Processing a maliciously crafted image may result in memory corruption\n        6.5MEDIUM\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43687\n        Kernel\n        Connecting to a malicious NFS server may disclose kernel memory\n        6.5MEDIUM\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-65330\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84538\n        Kernel\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84588\n        Kernel\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84487\n        SceneKit\n        Processing a maliciously crafted file may result in disclosure of process memory\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43719\n        SMB\n        Mounting a maliciously crafted SMB network share may lead to system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65365\n        SMB\n        Connecting to a malicious SMB share may disclose kernel memory\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84536\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43677\n        WebDAV\n        Connecting to a malicious WebDAV server may lead to unexpected app termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64715\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64753\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-64787\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64778\n        WebKit History\n        Visiting a maliciously crafted website may leak sensitive data\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84560\n        Bluetooth\n        An app may gain unauthorized access to Bluetooth\n        6.1MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84619\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        6.1MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84554\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.9MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43664\n        Accessibility\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-65404\n        Accounts\n        A malicious application may be able to bypass Privacy preferences\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84523\n        APFS\n        An app may be able to cause unexpected system termination or write kernel memory\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84586\n        Apple Account\n        A malicious application may be able to leak sensitive user information\n        5.5MEDIUM\n        NoNoYesNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65407\n        AppleAVD\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84593\n        AppleKeyStore\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        5.5MEDIUM\n        NoNoNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86905\n        Authentication Services\n        An app may be able to delete credentials stored in Keychain\n        5.5MEDIUM\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43737\n        CoreMotion\n        An app may be able to access motion data from headphones without user consent\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84489\n        CoreUI\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84534\n        file_cmds\n        Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-65409\n        Foundation\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64756\n        Image Capture\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        YesNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64760\n        IOSurfaceAccelerator\n        An app may be able to leak sensitive kernel state\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65401\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65402\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65405\n        Kernel\n        An app may be able to determine kernel memory layout\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84517\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84521\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-86903\n        Kernel\n        An app may be able to disclose kernel memory\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86883\n        Managed Configuration\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43741\n        Messages\n        An app may be able to access protected user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84491\n        Photos Storage\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84576\n        QuartzCore\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84555\n        Sandbox\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65413\n        SceneKit\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28937\n        Terminal\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        5.5MEDIUM\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65393\n        Xcode IDE\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoYes\n      \n      \n        CVE-2026-84617\n        XPC\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64788\n        IOGPUFamily\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-65341\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-34979\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.3MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86876\n        CoreMedia\n        A sandboxed process may be able to circumvent sandbox restrictions\n        5.2MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86889\n        Security\n        An attacker in a privileged network position may be able to intercept network traffic\n        4.8MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84492\n        Graphics\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84630\n        Kernel\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43690\n        SMB\n        A local user may be able to read kernel memory\n        4.7MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84518\n        Safari\n        A malicious website may be able to determine what apps a user has installed\n        4.3MEDIUM\n        YesNoYesNoNoNoNoNoYesNo\n      \n      \n        CVE-2026-43795\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64780\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64781\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64784\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65331\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65332\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65333\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65334\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65335\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65336\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65337\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65338\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65340\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65351\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64782\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64779\n        WebKit Storage\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86910\n        APFS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86888\n        App Store\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesNoYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84587\n        AppKit\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-20683\n        Apple Account\n        An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n        TBDTBD\n        YesNoYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84601\n        Apple Intelligence\n        An app may be able to bypass Apple Intelligence security prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65408\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84520\n        AppleFDEKeyStore\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65381\n        AppleMobileFileIntegrity\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84522\n        Archive Utility\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84584\n        Archive Utility\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65342\n        ATS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84525\n        ATS\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65339\n        Audio\n        An app may be able to leak sensitive user information\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84583\n        AuthKit\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84570\n        autofs\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65410\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84616\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65406\n        BackgroundAssets\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-86878\n        Camera\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84567\n        cd9660\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86893\n        CloudKit\n        An app may be able to read device name\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65399\n        copyfile\n        An archive may be able to bypass Gatekeeper\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86891\n        Core Bluetooth\n        An app may be able to access Bluetooth device information\n        TBDTBD\n        NoNoYesYesYesNoYesNoNoNo\n      \n      \n        CVE-2026-43683\n        CoreDrag\n        An app may be able to cause unexpected process termination or disclose process memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43789\n        CoreMedia\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65344\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43702\n        CoreMedia Video Toolbox\n        Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n        TBDTBD\n        NoYesNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84624\n        CoreML\n        A sandboxed app may be able to access restricted files\n        TBDTBD\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84559\n        CoreServices\n        A malicious application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84574\n        CoreServices\n        An app may be able to bypass Privacy preferences\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84511\n        CoreUI\n        Processing a maliciously crafted asset catalog may lead to unexpected process termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84571\n        CoreUI\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64790\n        CUPS\n        An app may be able to gain elevated privileges\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84540\n        CUPS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84541\n        CUPS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84612\n        DeviceCheck\n        An app may be able to read persistent device identifiers\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84512\n        Disk Images\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84550\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84552\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84565\n        Disk Images\n        Processing a maliciously crafted disk image may lead to unexpected app termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84510\n        exFAT\n        Mounting a maliciously crafted volume may lead to unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86900\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86901\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43785\n        File Bookmark\n        An app may be able to modify a file it only had permission to read\n        TBDTBD\n        YesNoYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43688\n        Filters\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84524\n        FontParser\n        Processing a maliciously crafted font file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84569\n        Foundation\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86911\n        Foundation\n        A malicious app may be able to bypass clickjacking protections for secure prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84618\n        Game Center\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84533\n        Heimdal\n        An attacker in a privileged network position may be able to modify network traffic\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-64714\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84564\n        ImageIO\n        Processing a maliciously crafted image may result in disclosure of process memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86869\n        ImageIO\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        NoYesYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoYesNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65398\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65354\n        iWork\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28935\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-28968\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43790\n        Kernel\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65358\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65359\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65360\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65369\n        Kernel\n        A malicious application may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65371\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65377\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84507\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84530\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84544\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84549\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84558\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84561\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84566\n        Kernel\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84602\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84622\n        Kernel\n        An app with root privileges may be able to read uninitialized kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84514\n        Kext Management\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84556\n        Keychain Access\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65382\n        LaunchServices\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86870\n        libarchive\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84577\n        libxpc\n        An app may be able to bypass sandbox restrictions\n        TBDTBD\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43787\n        Mail\n        An attacker in a privileged network position may be able to leak sensitive user information\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84573\n        Mail\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84628\n        MediaRemote\n        A sandboxed app may be able to access the System Keychain\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86924\n        MobileAccessoryUpdater\n        Connecting a malicious accessory may cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65411\n        MobileBackup\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84598\n        MobileBackup\n        An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84497\n        Model I/O\n        Opening a maliciously crafted file may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84615\n        Music\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesNoNoNoYesNoYesNoNo\n      \n      \n        CVE-2026-43695\n        NetworkExtension\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84585\n        NetworkExtension\n        An app may be able to access local network devices without user consent\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84626\n        NetworkExtension\n        An app may be able to identify what other apps a user has installed\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86902\n        NSDocument\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84629\n        Photos Storage\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84623\n        Power Management\n        An app may be able to fingerprint the device\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84578\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84580\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84548\n        Quick Look\n        Processing a maliciously crafted document may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28966\n        RealityKit\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84532\n        RealityKit\n        Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-65403\n        Reminders\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86897\n        Safe Browsing\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65380\n        Sandbox\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84551\n        Sandbox\n        An app may be able to bypass network restrictions\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84603\n        Sandbox Profiles\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84625\n        Sandbox Profiles\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43697\n        SceneKit\n        Processing a maliciously crafted 3D file may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84526\n        SceneKit\n        Processing a maliciously crafted 3D scene may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84546\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84620\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84531\n        Security\n        Processing maliciously crafted NTLM input may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86881\n        Security\n        An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84600\n        Shortcuts\n        A malicious shortcut may be able to send messages without user confirmation\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86884\n        Siri\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-86890\n        Siri Suggestions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65376\n        SMB\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84509\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84609\n        Software Update\n        An app may be able to modify protected system files\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65361\n        SoftwareUpdate\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65378\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84621\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86892\n        SpringBoard\n        An app may be able to cause a denial-of-service\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65345\n        Storage\n        An app may be able to access user-sensitive data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65348\n        Storage\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43791\n        StorageKit\n        An app may be able to read arbitrary files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84513\n        Symptom Framework\n        A malicious application may be able to determine a user's current location\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65383\n        System Settings\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86909\n        System Settings\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84527\n        TCC\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84589\n        TCC\n        An app may be able to modify Privacy preferences\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86886\n        TCC\n        An app may be able to modify protected system files\n        TBDTBD\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65329\n        Telephony\n        An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86887\n        Time Zone\n        An app may be able to bypass certain Privacy preferences\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43696\n        Touch Bar\n        An app may be able to capture Touch Bar content without authorization\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84572\n        udf\n        An app may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28899\n        WebDAV\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65375\n        WebDAV\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-84635\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-86898\n        WebKit\n        Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n        TBDTBD\n        YesNoYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-84636\n        Wi-Fi Connectivity\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43674\n        Wi-Fi3\n        An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n    \n    \n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-09-17T01:01:06.144033Z"}, {"uuid": "f7285175-7ca7-46f4-b904-ada3bfcc3fab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28930", "type": "seen", "source": "https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026", "content": "Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.\nFor the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn\u2019t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.\nCVE-2026-65400 \u2014 Screen Sharing Server (9.8 CRITICAL, \u26a0 CISA KEV).  This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.\nCVE-2026-65414 \u2014 Bluetooth (9.8 CRITICAL). This is the highest-scored non-exploited bug in the release. It\u2019s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it \"automatable: yes, technical impact: total.\" It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.\nCVE-2026-65346 \u2014 ImageIO (8.8 HIGH).  The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.\nTwo honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) \u2014 a sandbox-to-kernel arbitrary-code-execution bug \u2014 and CVE-2026-43790 (Kernel) \u2014 remote kernel memory corruption \u2014 are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\nApple Security Updates \u2014 September 14, 2026 (v27)\n\n\n    \n      273Total CVEs\n      134Scored\n      139TBD\n      2CRITICAL\n      46HIGH\n      84MEDIUM\n      2LOW\n    \n    \nCVSS is the NVD primary score where available, otherwise CISA-ADP secondary; TBD = NVD has not scored it yet (most v27 CVEs are still under analysis). \u26a0 KEV marks CVEs in CISA's Known Exploited Vulnerabilities catalog.\n    \n    \n\n      Apple security release — September 14, 2026 (version 27), 273 CVEs. CVSS/Severity from NVD (National Vulnerability Database) as of Sept 16, 2026. CVE IDs link to NVD. \"Yes/No\" indicates whether each update is affected.\n      \n          CVE IDComponentImpactCVSSSeverity\n          iOS / iPadOS 27\n          iOS / iPadOS 26.7\n          macOS 27 (Golden Gate)\n          macOS Tahoe 26.7\n          macOS Sequoia 15.8\n          tvOS 27\n          watchOS 27\n          visionOS 27\n          Safari 27\n          Xcode 27\n      \n      \n      \n        CVE-2026-65400\n        Screen Sharing Server\n        An attacker on the network may be able to authenticate to Screen Sharing without valid credentials\n        9.8\u26a0 KEV CRITICAL\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65414\n        Bluetooth\n        A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n        9.8CRITICAL\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43692\n        CUPS\n        A remote user may cause an unexpected app termination or arbitrary code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65346\n        ImageIO\n        Processing an image may lead to arbitrary code execution\n        8.8HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-43686\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        8.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65374\n        WebDAV\n        Connecting to a malicious WebDAV server may result in code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43794\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65390\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65391\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        8.6HIGH\n        NoNoNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84581\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        8.4HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84535\n        Automator\n        An app may be able to break out of its sandbox\n        8.2HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84516\n        CUPS\n        Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory\n        8.1HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65415\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        8.1HIGH\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84568\n        autofs\n        An attacker with control of a network directory server may be able to execute arbitrary code with root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84607\n        AVEVideoEncoder\n        A sandboxed app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84631\n        Bluetooth\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43786\n        CoreServices\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84575\n        CoreUI\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43691\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84505\n        Directory Utility\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65362\n        Disk Images\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        NoYesNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43684\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.8HIGH\n        NoYesYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43689\n        Kernel\n        A malicious app may be able to gain root privileges\n        7.8HIGH\n        YesYesYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86917\n        Kernel\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64712\n        odproxyd\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84515\n        SMB\n        Connecting to a malicious SMB server may lead to kernel memory corruption\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84506\n        udf\n        An app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64761\n        Accessibility\n        An app may be able to identify what other apps a user has installed\n        7.5HIGH\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86895\n        CloudKit\n        A local app may be able to read a persistent account identifier\n        7.5HIGH\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84563\n        CUPS\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84606\n        iCloud\n        An app may be able to identify a user across reinstalls\n        7.5HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        7.5HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28969\n        IOKit\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65343\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65364\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86894\n        libxpc\n        An app may be able to break out of its sandbox\n        7.5HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84543\n        SMB\n        Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84553\n        smbx\n        A remote attacker may be able to cause a denial-of-service\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28930\n        Spotlight\n        An app may be able to access protected user data\n        7.5HIGH\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-86904\n        Watch App\n        An app may be able to track users across apps and websites without permission\n        7.5HIGH\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-64752\n        CoreMedia\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        7.3HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84611\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84632\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64736\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.1HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-65349\n        Kernel\n        An app may be able to cause unexpected system termination or read kernel memory\n        6.6MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84537\n        SMB\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.6MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43788\n        Spotlight\n        Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n        6.6MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86882\n        Accelerate Framework\n        Processing a maliciously crafted image may lead to unexpected process termination\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84519\n        AppleDouble\n        Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n        6.5MEDIUM\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86879\n        Baseband\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86885\n        Baseband\n        An attacker in radio range may be able to cause unexpected system termination\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65412\n        CoreText\n        Processing web content may lead to a denial-of-service\n        6.5MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-84596\n        CoreText\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84597\n        FontParser\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2022-3437\n        Heimdal\n        A user in a privileged network position may be able to leak sensitive user information\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28934\n        HFS\n        Mounting a malicious disk image may cause unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65347\n        ImageIO\n        Processing an image may lead to a denial-of-service\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65395\n        ImageIO\n        Processing a maliciously crafted image may result in memory corruption\n        6.5MEDIUM\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43687\n        Kernel\n        Connecting to a malicious NFS server may disclose kernel memory\n        6.5MEDIUM\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-65330\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84538\n        Kernel\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84588\n        Kernel\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84487\n        SceneKit\n        Processing a maliciously crafted file may result in disclosure of process memory\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43719\n        SMB\n        Mounting a maliciously crafted SMB network share may lead to system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65365\n        SMB\n        Connecting to a malicious SMB share may disclose kernel memory\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84536\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43677\n        WebDAV\n        Connecting to a malicious WebDAV server may lead to unexpected app termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64715\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64753\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-64787\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64778\n        WebKit History\n        Visiting a maliciously crafted website may leak sensitive data\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84560\n        Bluetooth\n        An app may gain unauthorized access to Bluetooth\n        6.1MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84619\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        6.1MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84554\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.9MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43664\n        Accessibility\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-65404\n        Accounts\n        A malicious application may be able to bypass Privacy preferences\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84523\n        APFS\n        An app may be able to cause unexpected system termination or write kernel memory\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84586\n        Apple Account\n        A malicious application may be able to leak sensitive user information\n        5.5MEDIUM\n        NoNoYesNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65407\n        AppleAVD\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84593\n        AppleKeyStore\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        5.5MEDIUM\n        NoNoNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86905\n        Authentication Services\n        An app may be able to delete credentials stored in Keychain\n        5.5MEDIUM\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43737\n        CoreMotion\n        An app may be able to access motion data from headphones without user consent\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84489\n        CoreUI\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84534\n        file_cmds\n        Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-65409\n        Foundation\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64756\n        Image Capture\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        YesNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64760\n        IOSurfaceAccelerator\n        An app may be able to leak sensitive kernel state\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65401\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65402\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65405\n        Kernel\n        An app may be able to determine kernel memory layout\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84517\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84521\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-86903\n        Kernel\n        An app may be able to disclose kernel memory\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86883\n        Managed Configuration\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43741\n        Messages\n        An app may be able to access protected user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84491\n        Photos Storage\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84576\n        QuartzCore\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84555\n        Sandbox\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65413\n        SceneKit\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28937\n        Terminal\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        5.5MEDIUM\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65393\n        Xcode IDE\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoYes\n      \n      \n        CVE-2026-84617\n        XPC\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64788\n        IOGPUFamily\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-65341\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-34979\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.3MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86876\n        CoreMedia\n        A sandboxed process may be able to circumvent sandbox restrictions\n        5.2MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86889\n        Security\n        An attacker in a privileged network position may be able to intercept network traffic\n        4.8MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84492\n        Graphics\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84630\n        Kernel\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43690\n        SMB\n        A local user may be able to read kernel memory\n        4.7MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84518\n        Safari\n        A malicious website may be able to determine what apps a user has installed\n        4.3MEDIUM\n        YesNoYesNoNoNoNoNoYesNo\n      \n      \n        CVE-2026-43795\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64780\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64781\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64784\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65331\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65332\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65333\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65334\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65335\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65336\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65337\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65338\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65340\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65351\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64782\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64779\n        WebKit Storage\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86910\n        APFS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86888\n        App Store\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesNoYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84587\n        AppKit\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-20683\n        Apple Account\n        An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n        TBDTBD\n        YesNoYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84601\n        Apple Intelligence\n        An app may be able to bypass Apple Intelligence security prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65408\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84520\n        AppleFDEKeyStore\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65381\n        AppleMobileFileIntegrity\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84522\n        Archive Utility\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84584\n        Archive Utility\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65342\n        ATS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84525\n        ATS\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65339\n        Audio\n        An app may be able to leak sensitive user information\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84583\n        AuthKit\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84570\n        autofs\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65410\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84616\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65406\n        BackgroundAssets\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-86878\n        Camera\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84567\n        cd9660\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86893\n        CloudKit\n        An app may be able to read device name\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65399\n        copyfile\n        An archive may be able to bypass Gatekeeper\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86891\n        Core Bluetooth\n        An app may be able to access Bluetooth device information\n        TBDTBD\n        NoNoYesYesYesNoYesNoNoNo\n      \n      \n        CVE-2026-43683\n        CoreDrag\n        An app may be able to cause unexpected process termination or disclose process memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43789\n        CoreMedia\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65344\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43702\n        CoreMedia Video Toolbox\n        Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n        TBDTBD\n        NoYesNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84624\n        CoreML\n        A sandboxed app may be able to access restricted files\n        TBDTBD\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84559\n        CoreServices\n        A malicious application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84574\n        CoreServices\n        An app may be able to bypass Privacy preferences\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84511\n        CoreUI\n        Processing a maliciously crafted asset catalog may lead to unexpected process termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84571\n        CoreUI\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64790\n        CUPS\n        An app may be able to gain elevated privileges\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84540\n        CUPS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84541\n        CUPS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84612\n        DeviceCheck\n        An app may be able to read persistent device identifiers\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84512\n        Disk Images\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84550\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84552\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84565\n        Disk Images\n        Processing a maliciously crafted disk image may lead to unexpected app termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84510\n        exFAT\n        Mounting a maliciously crafted volume may lead to unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86900\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86901\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43785\n        File Bookmark\n        An app may be able to modify a file it only had permission to read\n        TBDTBD\n        YesNoYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43688\n        Filters\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84524\n        FontParser\n        Processing a maliciously crafted font file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84569\n        Foundation\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86911\n        Foundation\n        A malicious app may be able to bypass clickjacking protections for secure prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84618\n        Game Center\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84533\n        Heimdal\n        An attacker in a privileged network position may be able to modify network traffic\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-64714\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84564\n        ImageIO\n        Processing a maliciously crafted image may result in disclosure of process memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86869\n        ImageIO\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        NoYesYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoYesNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65398\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65354\n        iWork\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28935\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-28968\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43790\n        Kernel\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65358\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65359\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65360\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65369\n        Kernel\n        A malicious application may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65371\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65377\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84507\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84530\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84544\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84549\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84558\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84561\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84566\n        Kernel\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84602\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84622\n        Kernel\n        An app with root privileges may be able to read uninitialized kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84514\n        Kext Management\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84556\n        Keychain Access\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65382\n        LaunchServices\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86870\n        libarchive\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84577\n        libxpc\n        An app may be able to bypass sandbox restrictions\n        TBDTBD\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43787\n        Mail\n        An attacker in a privileged network position may be able to leak sensitive user information\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84573\n        Mail\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84628\n        MediaRemote\n        A sandboxed app may be able to access the System Keychain\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86924\n        MobileAccessoryUpdater\n        Connecting a malicious accessory may cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65411\n        MobileBackup\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84598\n        MobileBackup\n        An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84497\n        Model I/O\n        Opening a maliciously crafted file may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84615\n        Music\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesNoNoNoYesNoYesNoNo\n      \n      \n        CVE-2026-43695\n        NetworkExtension\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84585\n        NetworkExtension\n        An app may be able to access local network devices without user consent\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84626\n        NetworkExtension\n        An app may be able to identify what other apps a user has installed\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86902\n        NSDocument\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84629\n        Photos Storage\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84623\n        Power Management\n        An app may be able to fingerprint the device\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84578\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84580\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84548\n        Quick Look\n        Processing a maliciously crafted document may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28966\n        RealityKit\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84532\n        RealityKit\n        Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-65403\n        Reminders\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86897\n        Safe Browsing\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65380\n        Sandbox\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84551\n        Sandbox\n        An app may be able to bypass network restrictions\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84603\n        Sandbox Profiles\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84625\n        Sandbox Profiles\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43697\n        SceneKit\n        Processing a maliciously crafted 3D file may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84526\n        SceneKit\n        Processing a maliciously crafted 3D scene may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84546\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84620\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84531\n        Security\n        Processing maliciously crafted NTLM input may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86881\n        Security\n        An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84600\n        Shortcuts\n        A malicious shortcut may be able to send messages without user confirmation\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86884\n        Siri\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-86890\n        Siri Suggestions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65376\n        SMB\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84509\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84609\n        Software Update\n        An app may be able to modify protected system files\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65361\n        SoftwareUpdate\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65378\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84621\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86892\n        SpringBoard\n        An app may be able to cause a denial-of-service\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65345\n        Storage\n        An app may be able to access user-sensitive data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65348\n        Storage\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43791\n        StorageKit\n        An app may be able to read arbitrary files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84513\n        Symptom Framework\n        A malicious application may be able to determine a user's current location\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65383\n        System Settings\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86909\n        System Settings\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84527\n        TCC\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84589\n        TCC\n        An app may be able to modify Privacy preferences\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86886\n        TCC\n        An app may be able to modify protected system files\n        TBDTBD\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65329\n        Telephony\n        An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86887\n        Time Zone\n        An app may be able to bypass certain Privacy preferences\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43696\n        Touch Bar\n        An app may be able to capture Touch Bar content without authorization\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84572\n        udf\n        An app may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28899\n        WebDAV\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65375\n        WebDAV\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-84635\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-86898\n        WebKit\n        Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n        TBDTBD\n        YesNoYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-84636\n        Wi-Fi Connectivity\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43674\n        Wi-Fi3\n        An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n    \n    \n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-09-17T01:00:50.380791Z"}, {"uuid": "b8591f9d-a639-4bd2-a112-2b5bc105c6b2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28934", "type": "seen", "source": "https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026", "content": "Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.\nFor the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn\u2019t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.\nCVE-2026-65400 \u2014 Screen Sharing Server (9.8 CRITICAL, \u26a0 CISA KEV).  This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.\nCVE-2026-65414 \u2014 Bluetooth (9.8 CRITICAL). This is the highest-scored non-exploited bug in the release. It\u2019s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it \"automatable: yes, technical impact: total.\" It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.\nCVE-2026-65346 \u2014 ImageIO (8.8 HIGH).  The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.\nTwo honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) \u2014 a sandbox-to-kernel arbitrary-code-execution bug \u2014 and CVE-2026-43790 (Kernel) \u2014 remote kernel memory corruption \u2014 are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\nApple Security Updates \u2014 September 14, 2026 (v27)\n\n\n    \n      273Total CVEs\n      134Scored\n      139TBD\n      2CRITICAL\n      46HIGH\n      84MEDIUM\n      2LOW\n    \n    \nCVSS is the NVD primary score where available, otherwise CISA-ADP secondary; TBD = NVD has not scored it yet (most v27 CVEs are still under analysis). \u26a0 KEV marks CVEs in CISA's Known Exploited Vulnerabilities catalog.\n    \n    \n\n      Apple security release — September 14, 2026 (version 27), 273 CVEs. CVSS/Severity from NVD (National Vulnerability Database) as of Sept 16, 2026. CVE IDs link to NVD. \"Yes/No\" indicates whether each update is affected.\n      \n          CVE IDComponentImpactCVSSSeverity\n          iOS / iPadOS 27\n          iOS / iPadOS 26.7\n          macOS 27 (Golden Gate)\n          macOS Tahoe 26.7\n          macOS Sequoia 15.8\n          tvOS 27\n          watchOS 27\n          visionOS 27\n          Safari 27\n          Xcode 27\n      \n      \n      \n        CVE-2026-65400\n        Screen Sharing Server\n        An attacker on the network may be able to authenticate to Screen Sharing without valid credentials\n        9.8\u26a0 KEV CRITICAL\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65414\n        Bluetooth\n        A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n        9.8CRITICAL\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43692\n        CUPS\n        A remote user may cause an unexpected app termination or arbitrary code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65346\n        ImageIO\n        Processing an image may lead to arbitrary code execution\n        8.8HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-43686\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        8.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65374\n        WebDAV\n        Connecting to a malicious WebDAV server may result in code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43794\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65390\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65391\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        8.6HIGH\n        NoNoNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84581\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        8.4HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84535\n        Automator\n        An app may be able to break out of its sandbox\n        8.2HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84516\n        CUPS\n        Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory\n        8.1HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65415\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        8.1HIGH\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84568\n        autofs\n        An attacker with control of a network directory server may be able to execute arbitrary code with root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84607\n        AVEVideoEncoder\n        A sandboxed app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84631\n        Bluetooth\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43786\n        CoreServices\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84575\n        CoreUI\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43691\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84505\n        Directory Utility\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65362\n        Disk Images\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        NoYesNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43684\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.8HIGH\n        NoYesYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43689\n        Kernel\n        A malicious app may be able to gain root privileges\n        7.8HIGH\n        YesYesYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86917\n        Kernel\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64712\n        odproxyd\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84515\n        SMB\n        Connecting to a malicious SMB server may lead to kernel memory corruption\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84506\n        udf\n        An app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64761\n        Accessibility\n        An app may be able to identify what other apps a user has installed\n        7.5HIGH\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86895\n        CloudKit\n        A local app may be able to read a persistent account identifier\n        7.5HIGH\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84563\n        CUPS\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84606\n        iCloud\n        An app may be able to identify a user across reinstalls\n        7.5HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        7.5HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28969\n        IOKit\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65343\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65364\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86894\n        libxpc\n        An app may be able to break out of its sandbox\n        7.5HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84543\n        SMB\n        Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84553\n        smbx\n        A remote attacker may be able to cause a denial-of-service\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28930\n        Spotlight\n        An app may be able to access protected user data\n        7.5HIGH\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-86904\n        Watch App\n        An app may be able to track users across apps and websites without permission\n        7.5HIGH\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-64752\n        CoreMedia\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        7.3HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84611\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84632\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64736\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.1HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-65349\n        Kernel\n        An app may be able to cause unexpected system termination or read kernel memory\n        6.6MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84537\n        SMB\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.6MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43788\n        Spotlight\n        Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n        6.6MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86882\n        Accelerate Framework\n        Processing a maliciously crafted image may lead to unexpected process termination\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84519\n        AppleDouble\n        Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n        6.5MEDIUM\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86879\n        Baseband\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86885\n        Baseband\n        An attacker in radio range may be able to cause unexpected system termination\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65412\n        CoreText\n        Processing web content may lead to a denial-of-service\n        6.5MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-84596\n        CoreText\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84597\n        FontParser\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2022-3437\n        Heimdal\n        A user in a privileged network position may be able to leak sensitive user information\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28934\n        HFS\n        Mounting a malicious disk image may cause unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65347\n        ImageIO\n        Processing an image may lead to a denial-of-service\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65395\n        ImageIO\n        Processing a maliciously crafted image may result in memory corruption\n        6.5MEDIUM\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43687\n        Kernel\n        Connecting to a malicious NFS server may disclose kernel memory\n        6.5MEDIUM\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-65330\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84538\n        Kernel\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84588\n        Kernel\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84487\n        SceneKit\n        Processing a maliciously crafted file may result in disclosure of process memory\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43719\n        SMB\n        Mounting a maliciously crafted SMB network share may lead to system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65365\n        SMB\n        Connecting to a malicious SMB share may disclose kernel memory\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84536\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43677\n        WebDAV\n        Connecting to a malicious WebDAV server may lead to unexpected app termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64715\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64753\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-64787\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64778\n        WebKit History\n        Visiting a maliciously crafted website may leak sensitive data\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84560\n        Bluetooth\n        An app may gain unauthorized access to Bluetooth\n        6.1MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84619\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        6.1MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84554\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.9MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43664\n        Accessibility\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-65404\n        Accounts\n        A malicious application may be able to bypass Privacy preferences\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84523\n        APFS\n        An app may be able to cause unexpected system termination or write kernel memory\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84586\n        Apple Account\n        A malicious application may be able to leak sensitive user information\n        5.5MEDIUM\n        NoNoYesNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65407\n        AppleAVD\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84593\n        AppleKeyStore\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        5.5MEDIUM\n        NoNoNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86905\n        Authentication Services\n        An app may be able to delete credentials stored in Keychain\n        5.5MEDIUM\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43737\n        CoreMotion\n        An app may be able to access motion data from headphones without user consent\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84489\n        CoreUI\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84534\n        file_cmds\n        Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-65409\n        Foundation\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64756\n        Image Capture\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        YesNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64760\n        IOSurfaceAccelerator\n        An app may be able to leak sensitive kernel state\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65401\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65402\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65405\n        Kernel\n        An app may be able to determine kernel memory layout\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84517\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84521\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-86903\n        Kernel\n        An app may be able to disclose kernel memory\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86883\n        Managed Configuration\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43741\n        Messages\n        An app may be able to access protected user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84491\n        Photos Storage\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84576\n        QuartzCore\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84555\n        Sandbox\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65413\n        SceneKit\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28937\n        Terminal\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        5.5MEDIUM\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65393\n        Xcode IDE\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoYes\n      \n      \n        CVE-2026-84617\n        XPC\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64788\n        IOGPUFamily\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-65341\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-34979\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.3MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86876\n        CoreMedia\n        A sandboxed process may be able to circumvent sandbox restrictions\n        5.2MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86889\n        Security\n        An attacker in a privileged network position may be able to intercept network traffic\n        4.8MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84492\n        Graphics\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84630\n        Kernel\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43690\n        SMB\n        A local user may be able to read kernel memory\n        4.7MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84518\n        Safari\n        A malicious website may be able to determine what apps a user has installed\n        4.3MEDIUM\n        YesNoYesNoNoNoNoNoYesNo\n      \n      \n        CVE-2026-43795\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64780\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64781\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64784\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65331\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65332\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65333\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65334\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65335\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65336\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65337\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65338\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65340\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65351\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64782\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64779\n        WebKit Storage\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86910\n        APFS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86888\n        App Store\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesNoYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84587\n        AppKit\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-20683\n        Apple Account\n        An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n        TBDTBD\n        YesNoYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84601\n        Apple Intelligence\n        An app may be able to bypass Apple Intelligence security prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65408\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84520\n        AppleFDEKeyStore\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65381\n        AppleMobileFileIntegrity\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84522\n        Archive Utility\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84584\n        Archive Utility\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65342\n        ATS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84525\n        ATS\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65339\n        Audio\n        An app may be able to leak sensitive user information\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84583\n        AuthKit\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84570\n        autofs\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65410\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84616\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65406\n        BackgroundAssets\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-86878\n        Camera\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84567\n        cd9660\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86893\n        CloudKit\n        An app may be able to read device name\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65399\n        copyfile\n        An archive may be able to bypass Gatekeeper\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86891\n        Core Bluetooth\n        An app may be able to access Bluetooth device information\n        TBDTBD\n        NoNoYesYesYesNoYesNoNoNo\n      \n      \n        CVE-2026-43683\n        CoreDrag\n        An app may be able to cause unexpected process termination or disclose process memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43789\n        CoreMedia\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65344\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43702\n        CoreMedia Video Toolbox\n        Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n        TBDTBD\n        NoYesNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84624\n        CoreML\n        A sandboxed app may be able to access restricted files\n        TBDTBD\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84559\n        CoreServices\n        A malicious application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84574\n        CoreServices\n        An app may be able to bypass Privacy preferences\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84511\n        CoreUI\n        Processing a maliciously crafted asset catalog may lead to unexpected process termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84571\n        CoreUI\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64790\n        CUPS\n        An app may be able to gain elevated privileges\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84540\n        CUPS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84541\n        CUPS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84612\n        DeviceCheck\n        An app may be able to read persistent device identifiers\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84512\n        Disk Images\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84550\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84552\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84565\n        Disk Images\n        Processing a maliciously crafted disk image may lead to unexpected app termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84510\n        exFAT\n        Mounting a maliciously crafted volume may lead to unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86900\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86901\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43785\n        File Bookmark\n        An app may be able to modify a file it only had permission to read\n        TBDTBD\n        YesNoYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43688\n        Filters\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84524\n        FontParser\n        Processing a maliciously crafted font file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84569\n        Foundation\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86911\n        Foundation\n        A malicious app may be able to bypass clickjacking protections for secure prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84618\n        Game Center\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84533\n        Heimdal\n        An attacker in a privileged network position may be able to modify network traffic\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-64714\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84564\n        ImageIO\n        Processing a maliciously crafted image may result in disclosure of process memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86869\n        ImageIO\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        NoYesYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoYesNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65398\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65354\n        iWork\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28935\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-28968\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43790\n        Kernel\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65358\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65359\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65360\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65369\n        Kernel\n        A malicious application may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65371\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65377\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84507\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84530\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84544\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84549\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84558\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84561\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84566\n        Kernel\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84602\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84622\n        Kernel\n        An app with root privileges may be able to read uninitialized kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84514\n        Kext Management\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84556\n        Keychain Access\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65382\n        LaunchServices\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86870\n        libarchive\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84577\n        libxpc\n        An app may be able to bypass sandbox restrictions\n        TBDTBD\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43787\n        Mail\n        An attacker in a privileged network position may be able to leak sensitive user information\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84573\n        Mail\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84628\n        MediaRemote\n        A sandboxed app may be able to access the System Keychain\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86924\n        MobileAccessoryUpdater\n        Connecting a malicious accessory may cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65411\n        MobileBackup\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84598\n        MobileBackup\n        An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84497\n        Model I/O\n        Opening a maliciously crafted file may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84615\n        Music\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesNoNoNoYesNoYesNoNo\n      \n      \n        CVE-2026-43695\n        NetworkExtension\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84585\n        NetworkExtension\n        An app may be able to access local network devices without user consent\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84626\n        NetworkExtension\n        An app may be able to identify what other apps a user has installed\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86902\n        NSDocument\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84629\n        Photos Storage\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84623\n        Power Management\n        An app may be able to fingerprint the device\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84578\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84580\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84548\n        Quick Look\n        Processing a maliciously crafted document may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28966\n        RealityKit\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84532\n        RealityKit\n        Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-65403\n        Reminders\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86897\n        Safe Browsing\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65380\n        Sandbox\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84551\n        Sandbox\n        An app may be able to bypass network restrictions\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84603\n        Sandbox Profiles\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84625\n        Sandbox Profiles\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43697\n        SceneKit\n        Processing a maliciously crafted 3D file may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84526\n        SceneKit\n        Processing a maliciously crafted 3D scene may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84546\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84620\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84531\n        Security\n        Processing maliciously crafted NTLM input may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86881\n        Security\n        An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84600\n        Shortcuts\n        A malicious shortcut may be able to send messages without user confirmation\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86884\n        Siri\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-86890\n        Siri Suggestions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65376\n        SMB\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84509\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84609\n        Software Update\n        An app may be able to modify protected system files\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65361\n        SoftwareUpdate\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65378\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84621\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86892\n        SpringBoard\n        An app may be able to cause a denial-of-service\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65345\n        Storage\n        An app may be able to access user-sensitive data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65348\n        Storage\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43791\n        StorageKit\n        An app may be able to read arbitrary files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84513\n        Symptom Framework\n        A malicious application may be able to determine a user's current location\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65383\n        System Settings\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86909\n        System Settings\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84527\n        TCC\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84589\n        TCC\n        An app may be able to modify Privacy preferences\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86886\n        TCC\n        An app may be able to modify protected system files\n        TBDTBD\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65329\n        Telephony\n        An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86887\n        Time Zone\n        An app may be able to bypass certain Privacy preferences\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43696\n        Touch Bar\n        An app may be able to capture Touch Bar content without authorization\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84572\n        udf\n        An app may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28899\n        WebDAV\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65375\n        WebDAV\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-84635\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-86898\n        WebKit\n        Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n        TBDTBD\n        YesNoYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-84636\n        Wi-Fi Connectivity\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43674\n        Wi-Fi3\n        An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n    \n    \n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-09-17T01:00:54.239032Z"}, {"uuid": "9f2367d2-63ea-41ca-8410-9e9e4f9a278b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28969", "type": "seen", "source": "https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026", "content": "Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.\nFor the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn\u2019t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.\nCVE-2026-65400 \u2014 Screen Sharing Server (9.8 CRITICAL, \u26a0 CISA KEV).  This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.\nCVE-2026-65414 \u2014 Bluetooth (9.8 CRITICAL). This is the highest-scored non-exploited bug in the release. It\u2019s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it \"automatable: yes, technical impact: total.\" It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.\nCVE-2026-65346 \u2014 ImageIO (8.8 HIGH).  The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.\nTwo honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) \u2014 a sandbox-to-kernel arbitrary-code-execution bug \u2014 and CVE-2026-43790 (Kernel) \u2014 remote kernel memory corruption \u2014 are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\nApple Security Updates \u2014 September 14, 2026 (v27)\n\n\n    \n      273Total CVEs\n      134Scored\n      139TBD\n      2CRITICAL\n      46HIGH\n      84MEDIUM\n      2LOW\n    \n    \nCVSS is the NVD primary score where available, otherwise CISA-ADP secondary; TBD = NVD has not scored it yet (most v27 CVEs are still under analysis). \u26a0 KEV marks CVEs in CISA's Known Exploited Vulnerabilities catalog.\n    \n    \n\n      Apple security release — September 14, 2026 (version 27), 273 CVEs. CVSS/Severity from NVD (National Vulnerability Database) as of Sept 16, 2026. CVE IDs link to NVD. \"Yes/No\" indicates whether each update is affected.\n      \n          CVE IDComponentImpactCVSSSeverity\n          iOS / iPadOS 27\n          iOS / iPadOS 26.7\n          macOS 27 (Golden Gate)\n          macOS Tahoe 26.7\n          macOS Sequoia 15.8\n          tvOS 27\n          watchOS 27\n          visionOS 27\n          Safari 27\n          Xcode 27\n      \n      \n      \n        CVE-2026-65400\n        Screen Sharing Server\n        An attacker on the network may be able to authenticate to Screen Sharing without valid credentials\n        9.8\u26a0 KEV CRITICAL\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65414\n        Bluetooth\n        A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n        9.8CRITICAL\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43692\n        CUPS\n        A remote user may cause an unexpected app termination or arbitrary code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65346\n        ImageIO\n        Processing an image may lead to arbitrary code execution\n        8.8HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-43686\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        8.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65374\n        WebDAV\n        Connecting to a malicious WebDAV server may result in code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43794\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65390\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65391\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        8.6HIGH\n        NoNoNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84581\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        8.4HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84535\n        Automator\n        An app may be able to break out of its sandbox\n        8.2HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84516\n        CUPS\n        Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory\n        8.1HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65415\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        8.1HIGH\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84568\n        autofs\n        An attacker with control of a network directory server may be able to execute arbitrary code with root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84607\n        AVEVideoEncoder\n        A sandboxed app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84631\n        Bluetooth\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43786\n        CoreServices\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84575\n        CoreUI\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43691\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84505\n        Directory Utility\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65362\n        Disk Images\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        NoYesNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43684\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.8HIGH\n        NoYesYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43689\n        Kernel\n        A malicious app may be able to gain root privileges\n        7.8HIGH\n        YesYesYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86917\n        Kernel\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64712\n        odproxyd\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84515\n        SMB\n        Connecting to a malicious SMB server may lead to kernel memory corruption\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84506\n        udf\n        An app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64761\n        Accessibility\n        An app may be able to identify what other apps a user has installed\n        7.5HIGH\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86895\n        CloudKit\n        A local app may be able to read a persistent account identifier\n        7.5HIGH\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84563\n        CUPS\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84606\n        iCloud\n        An app may be able to identify a user across reinstalls\n        7.5HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        7.5HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28969\n        IOKit\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65343\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65364\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86894\n        libxpc\n        An app may be able to break out of its sandbox\n        7.5HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84543\n        SMB\n        Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84553\n        smbx\n        A remote attacker may be able to cause a denial-of-service\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28930\n        Spotlight\n        An app may be able to access protected user data\n        7.5HIGH\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-86904\n        Watch App\n        An app may be able to track users across apps and websites without permission\n        7.5HIGH\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-64752\n        CoreMedia\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        7.3HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84611\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84632\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64736\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.1HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-65349\n        Kernel\n        An app may be able to cause unexpected system termination or read kernel memory\n        6.6MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84537\n        SMB\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.6MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43788\n        Spotlight\n        Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n        6.6MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86882\n        Accelerate Framework\n        Processing a maliciously crafted image may lead to unexpected process termination\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84519\n        AppleDouble\n        Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n        6.5MEDIUM\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86879\n        Baseband\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86885\n        Baseband\n        An attacker in radio range may be able to cause unexpected system termination\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65412\n        CoreText\n        Processing web content may lead to a denial-of-service\n        6.5MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-84596\n        CoreText\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84597\n        FontParser\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2022-3437\n        Heimdal\n        A user in a privileged network position may be able to leak sensitive user information\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28934\n        HFS\n        Mounting a malicious disk image may cause unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65347\n        ImageIO\n        Processing an image may lead to a denial-of-service\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65395\n        ImageIO\n        Processing a maliciously crafted image may result in memory corruption\n        6.5MEDIUM\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43687\n        Kernel\n        Connecting to a malicious NFS server may disclose kernel memory\n        6.5MEDIUM\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-65330\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84538\n        Kernel\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84588\n        Kernel\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84487\n        SceneKit\n        Processing a maliciously crafted file may result in disclosure of process memory\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43719\n        SMB\n        Mounting a maliciously crafted SMB network share may lead to system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65365\n        SMB\n        Connecting to a malicious SMB share may disclose kernel memory\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84536\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43677\n        WebDAV\n        Connecting to a malicious WebDAV server may lead to unexpected app termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64715\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64753\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-64787\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64778\n        WebKit History\n        Visiting a maliciously crafted website may leak sensitive data\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84560\n        Bluetooth\n        An app may gain unauthorized access to Bluetooth\n        6.1MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84619\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        6.1MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84554\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.9MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43664\n        Accessibility\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-65404\n        Accounts\n        A malicious application may be able to bypass Privacy preferences\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84523\n        APFS\n        An app may be able to cause unexpected system termination or write kernel memory\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84586\n        Apple Account\n        A malicious application may be able to leak sensitive user information\n        5.5MEDIUM\n        NoNoYesNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65407\n        AppleAVD\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84593\n        AppleKeyStore\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        5.5MEDIUM\n        NoNoNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86905\n        Authentication Services\n        An app may be able to delete credentials stored in Keychain\n        5.5MEDIUM\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43737\n        CoreMotion\n        An app may be able to access motion data from headphones without user consent\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84489\n        CoreUI\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84534\n        file_cmds\n        Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-65409\n        Foundation\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64756\n        Image Capture\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        YesNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64760\n        IOSurfaceAccelerator\n        An app may be able to leak sensitive kernel state\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65401\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65402\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65405\n        Kernel\n        An app may be able to determine kernel memory layout\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84517\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84521\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-86903\n        Kernel\n        An app may be able to disclose kernel memory\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86883\n        Managed Configuration\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43741\n        Messages\n        An app may be able to access protected user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84491\n        Photos Storage\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84576\n        QuartzCore\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84555\n        Sandbox\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65413\n        SceneKit\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28937\n        Terminal\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        5.5MEDIUM\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65393\n        Xcode IDE\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoYes\n      \n      \n        CVE-2026-84617\n        XPC\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64788\n        IOGPUFamily\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-65341\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-34979\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.3MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86876\n        CoreMedia\n        A sandboxed process may be able to circumvent sandbox restrictions\n        5.2MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86889\n        Security\n        An attacker in a privileged network position may be able to intercept network traffic\n        4.8MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84492\n        Graphics\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84630\n        Kernel\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43690\n        SMB\n        A local user may be able to read kernel memory\n        4.7MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84518\n        Safari\n        A malicious website may be able to determine what apps a user has installed\n        4.3MEDIUM\n        YesNoYesNoNoNoNoNoYesNo\n      \n      \n        CVE-2026-43795\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64780\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64781\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64784\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65331\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65332\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65333\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65334\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65335\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65336\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65337\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65338\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65340\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65351\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64782\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64779\n        WebKit Storage\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86910\n        APFS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86888\n        App Store\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesNoYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84587\n        AppKit\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-20683\n        Apple Account\n        An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n        TBDTBD\n        YesNoYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84601\n        Apple Intelligence\n        An app may be able to bypass Apple Intelligence security prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65408\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84520\n        AppleFDEKeyStore\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65381\n        AppleMobileFileIntegrity\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84522\n        Archive Utility\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84584\n        Archive Utility\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65342\n        ATS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84525\n        ATS\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65339\n        Audio\n        An app may be able to leak sensitive user information\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84583\n        AuthKit\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84570\n        autofs\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65410\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84616\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65406\n        BackgroundAssets\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-86878\n        Camera\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84567\n        cd9660\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86893\n        CloudKit\n        An app may be able to read device name\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65399\n        copyfile\n        An archive may be able to bypass Gatekeeper\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86891\n        Core Bluetooth\n        An app may be able to access Bluetooth device information\n        TBDTBD\n        NoNoYesYesYesNoYesNoNoNo\n      \n      \n        CVE-2026-43683\n        CoreDrag\n        An app may be able to cause unexpected process termination or disclose process memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43789\n        CoreMedia\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65344\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43702\n        CoreMedia Video Toolbox\n        Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n        TBDTBD\n        NoYesNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84624\n        CoreML\n        A sandboxed app may be able to access restricted files\n        TBDTBD\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84559\n        CoreServices\n        A malicious application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84574\n        CoreServices\n        An app may be able to bypass Privacy preferences\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84511\n        CoreUI\n        Processing a maliciously crafted asset catalog may lead to unexpected process termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84571\n        CoreUI\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64790\n        CUPS\n        An app may be able to gain elevated privileges\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84540\n        CUPS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84541\n        CUPS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84612\n        DeviceCheck\n        An app may be able to read persistent device identifiers\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84512\n        Disk Images\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84550\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84552\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84565\n        Disk Images\n        Processing a maliciously crafted disk image may lead to unexpected app termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84510\n        exFAT\n        Mounting a maliciously crafted volume may lead to unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86900\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86901\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43785\n        File Bookmark\n        An app may be able to modify a file it only had permission to read\n        TBDTBD\n        YesNoYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43688\n        Filters\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84524\n        FontParser\n        Processing a maliciously crafted font file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84569\n        Foundation\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86911\n        Foundation\n        A malicious app may be able to bypass clickjacking protections for secure prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84618\n        Game Center\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84533\n        Heimdal\n        An attacker in a privileged network position may be able to modify network traffic\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-64714\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84564\n        ImageIO\n        Processing a maliciously crafted image may result in disclosure of process memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86869\n        ImageIO\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        NoYesYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoYesNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65398\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65354\n        iWork\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28935\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-28968\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43790\n        Kernel\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65358\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65359\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65360\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65369\n        Kernel\n        A malicious application may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65371\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65377\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84507\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84530\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84544\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84549\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84558\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84561\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84566\n        Kernel\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84602\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84622\n        Kernel\n        An app with root privileges may be able to read uninitialized kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84514\n        Kext Management\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84556\n        Keychain Access\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65382\n        LaunchServices\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86870\n        libarchive\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84577\n        libxpc\n        An app may be able to bypass sandbox restrictions\n        TBDTBD\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43787\n        Mail\n        An attacker in a privileged network position may be able to leak sensitive user information\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84573\n        Mail\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84628\n        MediaRemote\n        A sandboxed app may be able to access the System Keychain\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86924\n        MobileAccessoryUpdater\n        Connecting a malicious accessory may cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65411\n        MobileBackup\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84598\n        MobileBackup\n        An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84497\n        Model I/O\n        Opening a maliciously crafted file may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84615\n        Music\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesNoNoNoYesNoYesNoNo\n      \n      \n        CVE-2026-43695\n        NetworkExtension\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84585\n        NetworkExtension\n        An app may be able to access local network devices without user consent\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84626\n        NetworkExtension\n        An app may be able to identify what other apps a user has installed\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86902\n        NSDocument\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84629\n        Photos Storage\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84623\n        Power Management\n        An app may be able to fingerprint the device\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84578\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84580\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84548\n        Quick Look\n        Processing a maliciously crafted document may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28966\n        RealityKit\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84532\n        RealityKit\n        Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-65403\n        Reminders\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86897\n        Safe Browsing\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65380\n        Sandbox\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84551\n        Sandbox\n        An app may be able to bypass network restrictions\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84603\n        Sandbox Profiles\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84625\n        Sandbox Profiles\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43697\n        SceneKit\n        Processing a maliciously crafted 3D file may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84526\n        SceneKit\n        Processing a maliciously crafted 3D scene may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84546\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84620\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84531\n        Security\n        Processing maliciously crafted NTLM input may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86881\n        Security\n        An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84600\n        Shortcuts\n        A malicious shortcut may be able to send messages without user confirmation\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86884\n        Siri\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-86890\n        Siri Suggestions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65376\n        SMB\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84509\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84609\n        Software Update\n        An app may be able to modify protected system files\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65361\n        SoftwareUpdate\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65378\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84621\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86892\n        SpringBoard\n        An app may be able to cause a denial-of-service\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65345\n        Storage\n        An app may be able to access user-sensitive data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65348\n        Storage\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43791\n        StorageKit\n        An app may be able to read arbitrary files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84513\n        Symptom Framework\n        A malicious application may be able to determine a user's current location\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65383\n        System Settings\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86909\n        System Settings\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84527\n        TCC\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84589\n        TCC\n        An app may be able to modify Privacy preferences\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86886\n        TCC\n        An app may be able to modify protected system files\n        TBDTBD\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65329\n        Telephony\n        An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86887\n        Time Zone\n        An app may be able to bypass certain Privacy preferences\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43696\n        Touch Bar\n        An app may be able to capture Touch Bar content without authorization\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84572\n        udf\n        An app may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28899\n        WebDAV\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65375\n        WebDAV\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-84635\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-86898\n        WebKit\n        Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n        TBDTBD\n        YesNoYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-84636\n        Wi-Fi Connectivity\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43674\n        Wi-Fi3\n        An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n    \n    \n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-09-17T01:00:48.944348Z"}, {"uuid": "ea8c9af7-d97b-4cf7-8455-8d62925a9a94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28935", "type": "seen", "source": "https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026", "content": "Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.\nFor the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn\u2019t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.\nCVE-2026-65400 \u2014 Screen Sharing Server (9.8 CRITICAL, \u26a0 CISA KEV).  This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.\nCVE-2026-65414 \u2014 Bluetooth (9.8 CRITICAL). This is the highest-scored non-exploited bug in the release. It\u2019s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it \"automatable: yes, technical impact: total.\" It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.\nCVE-2026-65346 \u2014 ImageIO (8.8 HIGH).  The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.\nTwo honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) \u2014 a sandbox-to-kernel arbitrary-code-execution bug \u2014 and CVE-2026-43790 (Kernel) \u2014 remote kernel memory corruption \u2014 are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\nApple Security Updates \u2014 September 14, 2026 (v27)\n\n\n    \n      273Total CVEs\n      134Scored\n      139TBD\n      2CRITICAL\n      46HIGH\n      84MEDIUM\n      2LOW\n    \n    \nCVSS is the NVD primary score where available, otherwise CISA-ADP secondary; TBD = NVD has not scored it yet (most v27 CVEs are still under analysis). \u26a0 KEV marks CVEs in CISA's Known Exploited Vulnerabilities catalog.\n    \n    \n\n      Apple security release — September 14, 2026 (version 27), 273 CVEs. CVSS/Severity from NVD (National Vulnerability Database) as of Sept 16, 2026. CVE IDs link to NVD. \"Yes/No\" indicates whether each update is affected.\n      \n          CVE IDComponentImpactCVSSSeverity\n          iOS / iPadOS 27\n          iOS / iPadOS 26.7\n          macOS 27 (Golden Gate)\n          macOS Tahoe 26.7\n          macOS Sequoia 15.8\n          tvOS 27\n          watchOS 27\n          visionOS 27\n          Safari 27\n          Xcode 27\n      \n      \n      \n        CVE-2026-65400\n        Screen Sharing Server\n        An attacker on the network may be able to authenticate to Screen Sharing without valid credentials\n        9.8\u26a0 KEV CRITICAL\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65414\n        Bluetooth\n        A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n        9.8CRITICAL\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43692\n        CUPS\n        A remote user may cause an unexpected app termination or arbitrary code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65346\n        ImageIO\n        Processing an image may lead to arbitrary code execution\n        8.8HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-43686\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        8.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65374\n        WebDAV\n        Connecting to a malicious WebDAV server may result in code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43794\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65390\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65391\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        8.6HIGH\n        NoNoNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84581\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        8.4HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84535\n        Automator\n        An app may be able to break out of its sandbox\n        8.2HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84516\n        CUPS\n        Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory\n        8.1HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65415\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        8.1HIGH\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84568\n        autofs\n        An attacker with control of a network directory server may be able to execute arbitrary code with root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84607\n        AVEVideoEncoder\n        A sandboxed app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84631\n        Bluetooth\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43786\n        CoreServices\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84575\n        CoreUI\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43691\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84505\n        Directory Utility\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65362\n        Disk Images\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        NoYesNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43684\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.8HIGH\n        NoYesYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43689\n        Kernel\n        A malicious app may be able to gain root privileges\n        7.8HIGH\n        YesYesYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86917\n        Kernel\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64712\n        odproxyd\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84515\n        SMB\n        Connecting to a malicious SMB server may lead to kernel memory corruption\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84506\n        udf\n        An app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64761\n        Accessibility\n        An app may be able to identify what other apps a user has installed\n        7.5HIGH\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86895\n        CloudKit\n        A local app may be able to read a persistent account identifier\n        7.5HIGH\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84563\n        CUPS\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84606\n        iCloud\n        An app may be able to identify a user across reinstalls\n        7.5HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        7.5HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28969\n        IOKit\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65343\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65364\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86894\n        libxpc\n        An app may be able to break out of its sandbox\n        7.5HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84543\n        SMB\n        Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84553\n        smbx\n        A remote attacker may be able to cause a denial-of-service\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28930\n        Spotlight\n        An app may be able to access protected user data\n        7.5HIGH\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-86904\n        Watch App\n        An app may be able to track users across apps and websites without permission\n        7.5HIGH\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-64752\n        CoreMedia\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        7.3HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84611\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84632\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64736\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.1HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-65349\n        Kernel\n        An app may be able to cause unexpected system termination or read kernel memory\n        6.6MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84537\n        SMB\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.6MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43788\n        Spotlight\n        Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n        6.6MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86882\n        Accelerate Framework\n        Processing a maliciously crafted image may lead to unexpected process termination\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84519\n        AppleDouble\n        Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n        6.5MEDIUM\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86879\n        Baseband\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86885\n        Baseband\n        An attacker in radio range may be able to cause unexpected system termination\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65412\n        CoreText\n        Processing web content may lead to a denial-of-service\n        6.5MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-84596\n        CoreText\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84597\n        FontParser\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2022-3437\n        Heimdal\n        A user in a privileged network position may be able to leak sensitive user information\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28934\n        HFS\n        Mounting a malicious disk image may cause unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65347\n        ImageIO\n        Processing an image may lead to a denial-of-service\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65395\n        ImageIO\n        Processing a maliciously crafted image may result in memory corruption\n        6.5MEDIUM\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43687\n        Kernel\n        Connecting to a malicious NFS server may disclose kernel memory\n        6.5MEDIUM\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-65330\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84538\n        Kernel\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84588\n        Kernel\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84487\n        SceneKit\n        Processing a maliciously crafted file may result in disclosure of process memory\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43719\n        SMB\n        Mounting a maliciously crafted SMB network share may lead to system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65365\n        SMB\n        Connecting to a malicious SMB share may disclose kernel memory\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84536\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43677\n        WebDAV\n        Connecting to a malicious WebDAV server may lead to unexpected app termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64715\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64753\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-64787\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64778\n        WebKit History\n        Visiting a maliciously crafted website may leak sensitive data\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84560\n        Bluetooth\n        An app may gain unauthorized access to Bluetooth\n        6.1MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84619\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        6.1MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84554\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.9MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43664\n        Accessibility\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-65404\n        Accounts\n        A malicious application may be able to bypass Privacy preferences\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84523\n        APFS\n        An app may be able to cause unexpected system termination or write kernel memory\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84586\n        Apple Account\n        A malicious application may be able to leak sensitive user information\n        5.5MEDIUM\n        NoNoYesNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65407\n        AppleAVD\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84593\n        AppleKeyStore\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        5.5MEDIUM\n        NoNoNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86905\n        Authentication Services\n        An app may be able to delete credentials stored in Keychain\n        5.5MEDIUM\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43737\n        CoreMotion\n        An app may be able to access motion data from headphones without user consent\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84489\n        CoreUI\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84534\n        file_cmds\n        Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-65409\n        Foundation\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64756\n        Image Capture\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        YesNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64760\n        IOSurfaceAccelerator\n        An app may be able to leak sensitive kernel state\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65401\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65402\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65405\n        Kernel\n        An app may be able to determine kernel memory layout\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84517\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84521\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-86903\n        Kernel\n        An app may be able to disclose kernel memory\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86883\n        Managed Configuration\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43741\n        Messages\n        An app may be able to access protected user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84491\n        Photos Storage\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84576\n        QuartzCore\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84555\n        Sandbox\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65413\n        SceneKit\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28937\n        Terminal\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        5.5MEDIUM\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65393\n        Xcode IDE\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoYes\n      \n      \n        CVE-2026-84617\n        XPC\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64788\n        IOGPUFamily\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-65341\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-34979\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.3MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86876\n        CoreMedia\n        A sandboxed process may be able to circumvent sandbox restrictions\n        5.2MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86889\n        Security\n        An attacker in a privileged network position may be able to intercept network traffic\n        4.8MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84492\n        Graphics\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84630\n        Kernel\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43690\n        SMB\n        A local user may be able to read kernel memory\n        4.7MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84518\n        Safari\n        A malicious website may be able to determine what apps a user has installed\n        4.3MEDIUM\n        YesNoYesNoNoNoNoNoYesNo\n      \n      \n        CVE-2026-43795\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64780\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64781\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64784\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65331\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65332\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65333\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65334\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65335\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65336\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65337\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65338\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65340\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65351\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64782\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64779\n        WebKit Storage\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86910\n        APFS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86888\n        App Store\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesNoYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84587\n        AppKit\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-20683\n        Apple Account\n        An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n        TBDTBD\n        YesNoYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84601\n        Apple Intelligence\n        An app may be able to bypass Apple Intelligence security prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65408\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84520\n        AppleFDEKeyStore\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65381\n        AppleMobileFileIntegrity\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84522\n        Archive Utility\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84584\n        Archive Utility\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65342\n        ATS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84525\n        ATS\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65339\n        Audio\n        An app may be able to leak sensitive user information\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84583\n        AuthKit\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84570\n        autofs\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65410\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84616\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65406\n        BackgroundAssets\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-86878\n        Camera\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84567\n        cd9660\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86893\n        CloudKit\n        An app may be able to read device name\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65399\n        copyfile\n        An archive may be able to bypass Gatekeeper\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86891\n        Core Bluetooth\n        An app may be able to access Bluetooth device information\n        TBDTBD\n        NoNoYesYesYesNoYesNoNoNo\n      \n      \n        CVE-2026-43683\n        CoreDrag\n        An app may be able to cause unexpected process termination or disclose process memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43789\n        CoreMedia\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65344\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43702\n        CoreMedia Video Toolbox\n        Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n        TBDTBD\n        NoYesNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84624\n        CoreML\n        A sandboxed app may be able to access restricted files\n        TBDTBD\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84559\n        CoreServices\n        A malicious application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84574\n        CoreServices\n        An app may be able to bypass Privacy preferences\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84511\n        CoreUI\n        Processing a maliciously crafted asset catalog may lead to unexpected process termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84571\n        CoreUI\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64790\n        CUPS\n        An app may be able to gain elevated privileges\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84540\n        CUPS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84541\n        CUPS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84612\n        DeviceCheck\n        An app may be able to read persistent device identifiers\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84512\n        Disk Images\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84550\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84552\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84565\n        Disk Images\n        Processing a maliciously crafted disk image may lead to unexpected app termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84510\n        exFAT\n        Mounting a maliciously crafted volume may lead to unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86900\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86901\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43785\n        File Bookmark\n        An app may be able to modify a file it only had permission to read\n        TBDTBD\n        YesNoYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43688\n        Filters\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84524\n        FontParser\n        Processing a maliciously crafted font file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84569\n        Foundation\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86911\n        Foundation\n        A malicious app may be able to bypass clickjacking protections for secure prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84618\n        Game Center\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84533\n        Heimdal\n        An attacker in a privileged network position may be able to modify network traffic\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-64714\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84564\n        ImageIO\n        Processing a maliciously crafted image may result in disclosure of process memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86869\n        ImageIO\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        NoYesYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoYesNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65398\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65354\n        iWork\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28935\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-28968\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43790\n        Kernel\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65358\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65359\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65360\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65369\n        Kernel\n        A malicious application may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65371\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65377\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84507\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84530\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84544\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84549\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84558\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84561\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84566\n        Kernel\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84602\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84622\n        Kernel\n        An app with root privileges may be able to read uninitialized kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84514\n        Kext Management\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84556\n        Keychain Access\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65382\n        LaunchServices\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86870\n        libarchive\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84577\n        libxpc\n        An app may be able to bypass sandbox restrictions\n        TBDTBD\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43787\n        Mail\n        An attacker in a privileged network position may be able to leak sensitive user information\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84573\n        Mail\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84628\n        MediaRemote\n        A sandboxed app may be able to access the System Keychain\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86924\n        MobileAccessoryUpdater\n        Connecting a malicious accessory may cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65411\n        MobileBackup\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84598\n        MobileBackup\n        An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84497\n        Model I/O\n        Opening a maliciously crafted file may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84615\n        Music\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesNoNoNoYesNoYesNoNo\n      \n      \n        CVE-2026-43695\n        NetworkExtension\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84585\n        NetworkExtension\n        An app may be able to access local network devices without user consent\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84626\n        NetworkExtension\n        An app may be able to identify what other apps a user has installed\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86902\n        NSDocument\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84629\n        Photos Storage\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84623\n        Power Management\n        An app may be able to fingerprint the device\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84578\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84580\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84548\n        Quick Look\n        Processing a maliciously crafted document may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28966\n        RealityKit\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84532\n        RealityKit\n        Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-65403\n        Reminders\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86897\n        Safe Browsing\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65380\n        Sandbox\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84551\n        Sandbox\n        An app may be able to bypass network restrictions\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84603\n        Sandbox Profiles\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84625\n        Sandbox Profiles\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43697\n        SceneKit\n        Processing a maliciously crafted 3D file may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84526\n        SceneKit\n        Processing a maliciously crafted 3D scene may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84546\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84620\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84531\n        Security\n        Processing maliciously crafted NTLM input may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86881\n        Security\n        An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84600\n        Shortcuts\n        A malicious shortcut may be able to send messages without user confirmation\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86884\n        Siri\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-86890\n        Siri Suggestions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65376\n        SMB\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84509\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84609\n        Software Update\n        An app may be able to modify protected system files\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65361\n        SoftwareUpdate\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65378\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84621\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86892\n        SpringBoard\n        An app may be able to cause a denial-of-service\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65345\n        Storage\n        An app may be able to access user-sensitive data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65348\n        Storage\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43791\n        StorageKit\n        An app may be able to read arbitrary files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84513\n        Symptom Framework\n        A malicious application may be able to determine a user's current location\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65383\n        System Settings\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86909\n        System Settings\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84527\n        TCC\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84589\n        TCC\n        An app may be able to modify Privacy preferences\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86886\n        TCC\n        An app may be able to modify protected system files\n        TBDTBD\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65329\n        Telephony\n        An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86887\n        Time Zone\n        An app may be able to bypass certain Privacy preferences\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43696\n        Touch Bar\n        An app may be able to capture Touch Bar content without authorization\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84572\n        udf\n        An app may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28899\n        WebDAV\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65375\n        WebDAV\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-84635\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-86898\n        WebKit\n        Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n        TBDTBD\n        YesNoYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-84636\n        Wi-Fi Connectivity\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43674\n        Wi-Fi3\n        An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n    \n    \n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-09-17T01:01:27.208547Z"}, {"uuid": "6799dd2a-3812-47a0-b01b-695b14a49e8a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-28899", "type": "seen", "source": "https://www.thezdi.com/blog/2026/9/16/the-apple-security-update-review-for-september-2026", "content": "Welcome back to our monthly look at Apple security patches. This release shows Apple is not immune to the new normal of AI-assisted vulnerability discovery as they release patches for 273 total CVEs.\nFor the September 2026 release, Apple released 273 unique CVEs across macOS 27 (Golden Gate), macOS Sequoia 15.8, macOS Tahoe 26.7, iOS / iPadOS 27, visionOS 27, watchOS 27, tvOS 27, iOS / iPadOS 26.7, Safari 27, and Xcode 27. This patch release actually happened a couple of days ago, but since Apple doesn\u2019t provide CVSS scores or other severity information, it takes a couple of days to understand the full severity. Even with the additional time, there are many CVEs without a severity score. However, looking at the one that do have severity assigned by NVD or CISA-ADP, there are a few that truly stand out, including one under active exploit.\nCVE-2026-65400 \u2014 Screen Sharing Server (9.8 CRITICAL, \u26a0 CISA KEV).  This bug is confirmed by CISA to be actively exploited. A network attacker can authenticate to Screen Sharing without valid credentials, without user interaction. This component was first patched on August 6 and relisted in v27 as macOS 27/Tahoe 26.7 now carries the fix.\nCVE-2026-65414 \u2014 Bluetooth (9.8 CRITICAL). This is the highest-scored non-exploited bug in the release. It\u2019s remote, network-vector arbitrary code execution with no privileges or interaction, and CISA tagged it \"automatable: yes, technical impact: total.\" It spans all eight OS platforms, which is the broadest-reach critical vulnerability in the release and the most likely candidate to become a KEV entry.\nCVE-2026-65346 \u2014 ImageIO (8.8 HIGH).  The bug sits at the top of the HIGH tier and is the most dangerous remote content bug: processing a malicious image leads to arbitrary code execution. ImageIO is the canonical zero-/one-click surface (images auto-rendered in Messages, previews), so it carries high real-world weaponization potential.\nTwo honorable mentions that matter because of a data caveat: CVE-2026-84607 (AVEVideoEncoder) \u2014 a sandbox-to-kernel arbitrary-code-execution bug \u2014 and CVE-2026-43790 (Kernel) \u2014 remote kernel memory corruption \u2014 are arguably more severe by impact than #3, but NVD hasn't scored either yet (both TBD), so they don't rank on the current evidence. Also worth noting: CVE-2026-43692 (CUPS) remote code execution and CVE-2026-84568 (autofs) root RCE both sit at the top of the HIGH band.\nHere\u2019s the full table of Apple patches and the products they affect:\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n  \n  \n\n\n\n\n  \n\n\n  \n    \n\nApple Security Updates \u2014 September 14, 2026 (v27)\n\n\n    \n      273Total CVEs\n      134Scored\n      139TBD\n      2CRITICAL\n      46HIGH\n      84MEDIUM\n      2LOW\n    \n    \nCVSS is the NVD primary score where available, otherwise CISA-ADP secondary; TBD = NVD has not scored it yet (most v27 CVEs are still under analysis). \u26a0 KEV marks CVEs in CISA's Known Exploited Vulnerabilities catalog.\n    \n    \n\n      Apple security release — September 14, 2026 (version 27), 273 CVEs. CVSS/Severity from NVD (National Vulnerability Database) as of Sept 16, 2026. CVE IDs link to NVD. \"Yes/No\" indicates whether each update is affected.\n      \n          CVE IDComponentImpactCVSSSeverity\n          iOS / iPadOS 27\n          iOS / iPadOS 26.7\n          macOS 27 (Golden Gate)\n          macOS Tahoe 26.7\n          macOS Sequoia 15.8\n          tvOS 27\n          watchOS 27\n          visionOS 27\n          Safari 27\n          Xcode 27\n      \n      \n      \n        CVE-2026-65400\n        Screen Sharing Server\n        An attacker on the network may be able to authenticate to Screen Sharing without valid credentials\n        9.8\u26a0 KEV CRITICAL\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65414\n        Bluetooth\n        A remote attacker may be able to cause unexpected app termination or arbitrary code execution\n        9.8CRITICAL\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43692\n        CUPS\n        A remote user may cause an unexpected app termination or arbitrary code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65346\n        ImageIO\n        Processing an image may lead to arbitrary code execution\n        8.8HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-43686\n        Kernel\n        Connecting to a malicious NFS server may lead to kernel memory corruption\n        8.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65374\n        WebDAV\n        Connecting to a malicious WebDAV server may result in code execution\n        8.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43715\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43794\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65390\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65391\n        WebRTC\n        Processing maliciously crafted web content may lead to memory corruption\n        8.8HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43760\n        Screen Sharing Server\n        An app may be able to access user-sensitive data\n        8.6HIGH\n        NoNoNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84581\n        HFS\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        8.4HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84535\n        Automator\n        An app may be able to break out of its sandbox\n        8.2HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84516\n        CUPS\n        Processing a maliciously crafted file may result in unexpected app termination or disclosure of process memory\n        8.1HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65415\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        8.1HIGH\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84568\n        autofs\n        An attacker with control of a network directory server may be able to execute arbitrary code with root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84607\n        AVEVideoEncoder\n        A sandboxed app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84631\n        Bluetooth\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43786\n        CoreServices\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84575\n        CoreUI\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43691\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43698\n        CUPS\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-84505\n        Directory Utility\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65362\n        Disk Images\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64758\n        ImageIO\n        Processing a maliciously crafted file may lead to unexpected app termination\n        7.8HIGH\n        NoYesNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43684\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.8HIGH\n        NoYesYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-43689\n        Kernel\n        A malicious app may be able to gain root privileges\n        7.8HIGH\n        YesYesYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86917\n        Kernel\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64712\n        odproxyd\n        An app may be able to gain root privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84515\n        SMB\n        Connecting to a malicious SMB server may lead to kernel memory corruption\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84506\n        udf\n        An app may be able to execute arbitrary code with kernel privileges\n        7.8HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64761\n        Accessibility\n        An app may be able to identify what other apps a user has installed\n        7.5HIGH\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86895\n        CloudKit\n        A local app may be able to read a persistent account identifier\n        7.5HIGH\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84563\n        CUPS\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84606\n        iCloud\n        An app may be able to identify a user across reinstalls\n        7.5HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43661\n        ImageIO\n        Processing a maliciously crafted image may corrupt process memory\n        7.5HIGH\n        NoYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28969\n        IOKit\n        An app may be able to cause unexpected system termination\n        7.5HIGH\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65343\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65364\n        Kernel\n        A remote attacker may be able to cause unexpected system termination\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86894\n        libxpc\n        An app may be able to break out of its sandbox\n        7.5HIGH\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84543\n        SMB\n        Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84553\n        smbx\n        A remote attacker may be able to cause a denial-of-service\n        7.5HIGH\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28930\n        Spotlight\n        An app may be able to access protected user data\n        7.5HIGH\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-86904\n        Watch App\n        An app may be able to track users across apps and websites without permission\n        7.5HIGH\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-64752\n        CoreMedia\n        Processing a maliciously crafted image may lead to arbitrary code execution\n        7.3HIGH\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84611\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84632\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        7.3HIGH\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64736\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        7.1HIGH\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-65349\n        Kernel\n        An app may be able to cause unexpected system termination or read kernel memory\n        6.6MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84537\n        SMB\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.6MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43788\n        Spotlight\n        Processing a maliciously crafted file may lead to a denial-of-service or potentially disclose memory contents\n        6.6MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86882\n        Accelerate Framework\n        Processing a maliciously crafted image may lead to unexpected process termination\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84519\n        AppleDouble\n        Mounting a disk image with maliciously crafted files may lead to unexpected system termination\n        6.5MEDIUM\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86879\n        Baseband\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86885\n        Baseband\n        An attacker in radio range may be able to cause unexpected system termination\n        6.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65412\n        CoreText\n        Processing web content may lead to a denial-of-service\n        6.5MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-84596\n        CoreText\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84597\n        FontParser\n        Processing a maliciously crafted font may result in the disclosure of process memory\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2022-3437\n        Heimdal\n        A user in a privileged network position may be able to leak sensitive user information\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28934\n        HFS\n        Mounting a malicious disk image may cause unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65347\n        ImageIO\n        Processing an image may lead to a denial-of-service\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65395\n        ImageIO\n        Processing a maliciously crafted image may result in memory corruption\n        6.5MEDIUM\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43687\n        Kernel\n        Connecting to a malicious NFS server may disclose kernel memory\n        6.5MEDIUM\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-65330\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84538\n        Kernel\n        A remote attacker may be able to cause a denial-of-service\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84588\n        Kernel\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        6.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84487\n        SceneKit\n        Processing a maliciously crafted file may result in disclosure of process memory\n        6.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43719\n        SMB\n        Mounting a maliciously crafted SMB network share may lead to system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65365\n        SMB\n        Connecting to a malicious SMB share may disclose kernel memory\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84536\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43677\n        WebDAV\n        Connecting to a malicious WebDAV server may lead to unexpected app termination\n        6.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64715\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process crash\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64753\n        WebKit\n        Processing maliciously crafted web content may disclose sensitive user information\n        6.5MEDIUM\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-64787\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64778\n        WebKit History\n        Visiting a maliciously crafted website may leak sensitive data\n        6.5MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84560\n        Bluetooth\n        An app may gain unauthorized access to Bluetooth\n        6.1MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84619\n        Kernel\n        An app may be able to cause unexpected system termination or write kernel memory\n        6.1MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84554\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.9MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43664\n        Accessibility\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-65404\n        Accounts\n        A malicious application may be able to bypass Privacy preferences\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84523\n        APFS\n        An app may be able to cause unexpected system termination or write kernel memory\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84586\n        Apple Account\n        A malicious application may be able to leak sensitive user information\n        5.5MEDIUM\n        NoNoYesNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65407\n        AppleAVD\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84593\n        AppleKeyStore\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43763\n        ATS\n        An app may be able to read files outside of its sandbox\n        5.5MEDIUM\n        NoNoNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86905\n        Authentication Services\n        An app may be able to delete credentials stored in Keychain\n        5.5MEDIUM\n        YesNoYesNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43737\n        CoreMotion\n        An app may be able to access motion data from headphones without user consent\n        5.5MEDIUM\n        YesYesYesYesYesYesYesNoNoNo\n      \n      \n        CVE-2026-43738\n        CoreUI\n        Processing a maliciously crafted asset catalog may result in disclosure of process memory\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84489\n        CoreUI\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84534\n        file_cmds\n        Extracting a maliciously crafted archive may allow an attacker to write arbitrary files\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-65409\n        Foundation\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-64756\n        Image Capture\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        YesNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-64760\n        IOSurfaceAccelerator\n        An app may be able to leak sensitive kernel state\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65401\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65402\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65405\n        Kernel\n        An app may be able to determine kernel memory layout\n        5.5MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84517\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84521\n        Kernel\n        An app may be able to cause unexpected system termination\n        5.5MEDIUM\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-86903\n        Kernel\n        An app may be able to disclose kernel memory\n        5.5MEDIUM\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86883\n        Managed Configuration\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43741\n        Messages\n        An app may be able to access protected user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84491\n        Photos Storage\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84576\n        QuartzCore\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84555\n        Sandbox\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65413\n        SceneKit\n        An app may be able to cause a denial of service\n        5.5MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28937\n        Terminal\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-64718\n        WebKit Canvas\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        5.5MEDIUM\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65393\n        Xcode IDE\n        An app may be able to access user-sensitive data\n        5.5MEDIUM\n        NoNoYesNoNoNoNoNoNoYes\n      \n      \n        CVE-2026-84617\n        XPC\n        An app may be able to access sensitive user data\n        5.5MEDIUM\n        YesYesYesYesYesYesNoNoNoNo\n      \n      \n        CVE-2026-64788\n        IOGPUFamily\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-65341\n        WebKit\n        Processing maliciously crafted web content may lead to memory corruption\n        5.4MEDIUM\n        NoNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-34979\n        CUPS\n        An attacker in a privileged network position may be able to cause a denial-of-service\n        5.3MEDIUM\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86876\n        CoreMedia\n        A sandboxed process may be able to circumvent sandbox restrictions\n        5.2MEDIUM\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86889\n        Security\n        An attacker in a privileged network position may be able to intercept network traffic\n        4.8MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84492\n        Graphics\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84630\n        Kernel\n        An app may be able to cause unexpected system termination\n        4.7MEDIUM\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43690\n        SMB\n        A local user may be able to read kernel memory\n        4.7MEDIUM\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84518\n        Safari\n        A malicious website may be able to determine what apps a user has installed\n        4.3MEDIUM\n        YesNoYesNoNoNoNoNoYesNo\n      \n      \n        CVE-2026-43795\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64780\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64781\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64784\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65331\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65332\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65333\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65334\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65335\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65336\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65337\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65338\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65340\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65351\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        4.3MEDIUM\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64782\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-64779\n        WebKit Storage\n        Processing maliciously crafted web content may lead to an unexpected Safari crash\n        3.1LOW\n        NoNoNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-86910\n        APFS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86888\n        App Store\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesNoYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84587\n        AppKit\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-20683\n        Apple Account\n        An app may be able to use the Sign In With Apple authentication flow to access the user's Apple Account\n        TBDTBD\n        YesNoYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84601\n        Apple Intelligence\n        An app may be able to bypass Apple Intelligence security prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65408\n        Apple Neural Engine\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84520\n        AppleFDEKeyStore\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65381\n        AppleMobileFileIntegrity\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84522\n        Archive Utility\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84584\n        Archive Utility\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65342\n        ATS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84525\n        ATS\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65339\n        Audio\n        An app may be able to leak sensitive user information\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-84583\n        AuthKit\n        A local app may be able to read a persistent account identifier\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84570\n        autofs\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65410\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84616\n        AVEVideoEncoder\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65406\n        BackgroundAssets\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-86878\n        Camera\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84567\n        cd9660\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86893\n        CloudKit\n        An app may be able to read device name\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65399\n        copyfile\n        An archive may be able to bypass Gatekeeper\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86891\n        Core Bluetooth\n        An app may be able to access Bluetooth device information\n        TBDTBD\n        NoNoYesYesYesNoYesNoNoNo\n      \n      \n        CVE-2026-43683\n        CoreDrag\n        An app may be able to cause unexpected process termination or disclose process memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43789\n        CoreMedia\n        An app may be able to access user-sensitive data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65344\n        CoreMedia\n        Processing a maliciously crafted video file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43702\n        CoreMedia Video Toolbox\n        Processing a maliciously crafted video file may lead to unexpected app termination or corrupt process memory\n        TBDTBD\n        NoYesNoYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84624\n        CoreML\n        A sandboxed app may be able to access restricted files\n        TBDTBD\n        YesYesYesYesYesNoNoYesNoNo\n      \n      \n        CVE-2026-84559\n        CoreServices\n        A malicious application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84574\n        CoreServices\n        An app may be able to bypass Privacy preferences\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84511\n        CoreUI\n        Processing a maliciously crafted asset catalog may lead to unexpected process termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84571\n        CoreUI\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-64790\n        CUPS\n        An app may be able to gain elevated privileges\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84540\n        CUPS\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84541\n        CUPS\n        An application may be able to access restricted files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84612\n        DeviceCheck\n        An app may be able to read persistent device identifiers\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84512\n        Disk Images\n        Mounting a maliciously crafted disk image may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84550\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84552\n        Disk Images\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84565\n        Disk Images\n        Processing a maliciously crafted disk image may lead to unexpected app termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84510\n        exFAT\n        Mounting a maliciously crafted volume may lead to unexpected system termination\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86900\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86901\n        exFAT\n        Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43785\n        File Bookmark\n        An app may be able to modify a file it only had permission to read\n        TBDTBD\n        YesNoYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-43688\n        Filters\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84524\n        FontParser\n        Processing a maliciously crafted font file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84569\n        Foundation\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86911\n        Foundation\n        A malicious app may be able to bypass clickjacking protections for secure prompts\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84618\n        Game Center\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84533\n        Heimdal\n        An attacker in a privileged network position may be able to modify network traffic\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-64714\n        ImageIO\n        Processing a maliciously crafted image may lead to a denial-of-service\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84564\n        ImageIO\n        Processing a maliciously crafted image may result in disclosure of process memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86869\n        ImageIO\n        Processing a maliciously crafted image may lead to unexpected app termination\n        TBDTBD\n        NoYesYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-43743\n        IOGPUFamily\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoYesNoYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65398\n        IOMobileFrameBuffer\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-65354\n        iWork\n        A malicious app may be able to break out of its sandbox\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-28935\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoNoNoYesYesYesYesNoNo\n      \n      \n        CVE-2026-28968\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-43790\n        Kernel\n        A remote attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65358\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65359\n        Kernel\n        A local user may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65360\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65369\n        Kernel\n        A malicious application may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65371\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        NoNoNoNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-65377\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84507\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84530\n        Kernel\n        An app may be able to disclose kernel memory\n        TBDTBD\n        YesYesYesYesNoYesYesYesNoNo\n      \n      \n        CVE-2026-84544\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84549\n        Kernel\n        Connecting to a malicious NFS server may cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84558\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84561\n        Kernel\n        An app may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84566\n        Kernel\n        A local attacker may be able to cause unexpected system termination or corrupt kernel memory\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84602\n        Kernel\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84622\n        Kernel\n        An app with root privileges may be able to read uninitialized kernel memory\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84514\n        Kext Management\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84556\n        Keychain Access\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65382\n        LaunchServices\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86870\n        libarchive\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84577\n        libxpc\n        An app may be able to bypass sandbox restrictions\n        TBDTBD\n        NoNoYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-43787\n        Mail\n        An attacker in a privileged network position may be able to leak sensitive user information\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84573\n        Mail\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84628\n        MediaRemote\n        A sandboxed app may be able to access the System Keychain\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86924\n        MobileAccessoryUpdater\n        Connecting a malicious accessory may cause unexpected system termination\n        TBDTBD\n        YesYesYesYesNoNoNoNoNoNo\n      \n      \n        CVE-2026-65411\n        MobileBackup\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-84598\n        MobileBackup\n        An attacker with physical access to a trust-paired device may be able to read and write arbitrary files\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84497\n        Model I/O\n        Opening a maliciously crafted file may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84615\n        Music\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesNoNoNoYesNoYesNoNo\n      \n      \n        CVE-2026-43695\n        NetworkExtension\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84585\n        NetworkExtension\n        An app may be able to access local network devices without user consent\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84626\n        NetworkExtension\n        An app may be able to identify what other apps a user has installed\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-86902\n        NSDocument\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84629\n        Photos Storage\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-84623\n        Power Management\n        An app may be able to fingerprint the device\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84578\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84580\n        quarantine\n        An app may be able to break out of its sandbox\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84548\n        Quick Look\n        Processing a maliciously crafted document may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28966\n        RealityKit\n        Processing a maliciously crafted file may lead to unexpected app termination\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-84532\n        RealityKit\n        Opening a maliciously crafted file may cause unexpected process termination or disclose process memory\n        TBDTBD\n        YesYesYesYesYesYesNoYesNoNo\n      \n      \n        CVE-2026-65403\n        Reminders\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoYesYesNoNo\n      \n      \n        CVE-2026-86897\n        Safe Browsing\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-65380\n        Sandbox\n        An app may be able to access protected user data\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84551\n        Sandbox\n        An app may be able to bypass network restrictions\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84603\n        Sandbox Profiles\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-84625\n        Sandbox Profiles\n        An app may be able to fingerprint the user\n        TBDTBD\n        YesNoYesNoNoNoYesYesNoNo\n      \n      \n        CVE-2026-43697\n        SceneKit\n        Processing a maliciously crafted 3D file may lead to an out-of-bounds read\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84526\n        SceneKit\n        Processing a maliciously crafted 3D scene may lead to unexpected process termination\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84546\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84620\n        SceneKit\n        Processing a maliciously crafted 3D model may lead to memory corruption\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84531\n        Security\n        Processing maliciously crafted NTLM input may lead to unexpected app termination\n        TBDTBD\n        YesNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86881\n        Security\n        An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84600\n        Shortcuts\n        A malicious shortcut may be able to send messages without user confirmation\n        TBDTBD\n        YesNoYesNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-86884\n        Siri\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesNoNoYesYesNoNoNo\n      \n      \n        CVE-2026-86890\n        Siri Suggestions\n        An attacker with physical access to a locked device may be able to view sensitive user information\n        TBDTBD\n        YesYesNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-65376\n        SMB\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84509\n        SMB\n        Connecting to a malicious SMB server may lead to unexpected system termination\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84609\n        Software Update\n        An app may be able to modify protected system files\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65361\n        SoftwareUpdate\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65378\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84621\n        Spotlight\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-86892\n        SpringBoard\n        An app may be able to cause a denial-of-service\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-65345\n        Storage\n        An app may be able to access user-sensitive data\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65348\n        Storage\n        An app may be able to modify protected parts of the file system\n        TBDTBD\n        YesYesYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-43791\n        StorageKit\n        An app may be able to read arbitrary files\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-84513\n        Symptom Framework\n        A malicious application may be able to determine a user's current location\n        TBDTBD\n        YesYesYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-65383\n        System Settings\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86909\n        System Settings\n        An app may be able to bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84527\n        TCC\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoYesYesYesYesYesYesNoNo\n      \n      \n        CVE-2026-84589\n        TCC\n        An app may be able to modify Privacy preferences\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86886\n        TCC\n        An app may be able to modify protected system files\n        TBDTBD\n        YesYesNoNoNoNoYesNoNoNo\n      \n      \n        CVE-2026-65329\n        Telephony\n        An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-86887\n        Time Zone\n        An app may be able to bypass certain Privacy preferences\n        TBDTBD\n        YesYesNoNoNoNoNoYesNoNo\n      \n      \n        CVE-2026-43696\n        Touch Bar\n        An app may be able to capture Touch Bar content without authorization\n        TBDTBD\n        NoNoYesNoNoNoNoNoNoNo\n      \n      \n        CVE-2026-84572\n        udf\n        An app may be able to cause unexpected system termination or read kernel memory\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-28899\n        WebDAV\n        An app may bypass Gatekeeper checks\n        TBDTBD\n        NoNoYesYesYesNoNoNoNoNo\n      \n      \n        CVE-2026-65375\n        WebDAV\n        An app may be able to cause unexpected system termination\n        TBDTBD\n        NoNoYesNoYesNoNoNoNoNo\n      \n      \n        CVE-2026-84635\n        WebKit\n        Processing maliciously crafted web content may lead to an unexpected process termination\n        TBDTBD\n        YesNoYesNoNoYesYesYesYesNo\n      \n      \n        CVE-2026-86898\n        WebKit\n        Opening a maliciously crafted webarchive file may lead to universal cross-site scripting\n        TBDTBD\n        YesNoYesNoNoNoNoYesYesNo\n      \n      \n        CVE-2026-84636\n        Wi-Fi Connectivity\n        An app may be able to access sensitive user data\n        TBDTBD\n        YesNoNoNoNoYesYesYesNoNo\n      \n      \n        CVE-2026-43674\n        Wi-Fi3\n        An attacker with physical access to an unlocked device may be able to view Wi-Fi passwords without authentication\n        TBDTBD\n        YesNoNoNoNoNoNoNoNoNo\n      \n      \n    \n    \n\n\n  \n  \n\n\n\n\n\n\n\n\n\n\n  \nWe\u2019ll continue these macOS updates if people find them useful. Stay tuned for the regularly schedule Patch Tuesday blog covering Adobe and Microsoft.", "creation_timestamp": "2026-09-17T01:01:42.854791Z"}]}