{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Apple heeft meerdere kwetsbaarheden verholpen in diverse versies van iOS en iPadOS",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden betreffen onder andere onjuiste geheugenbeheermechanismen zoals use-after-free, buffer overflows, out-of-bounds reads en writes, race conditions, type confusion, null pointer dereferences, en onvoldoende inputvalidatie. Deze kunnen leiden tot onverwachte applicatie- of systeemcrashes, denial-of-service, ongeautoriseerde toegang tot gevoelige gebruikers- of kerneldata, privilege-escalatie, en het omzeilen van beveiligingsmechanismen zoals Content Security Policy en sandboxing. Sommige kwetsbaarheden maken het mogelijk dat een aanvaller code met kernel-privileges uitvoert of systeemstabiliteit verstoort. De problemen kunnen worden geactiveerd door het verwerken van speciaal vervaardigde bestanden, webcontent, of netwerkverkeer. De fixes omvatten verbeterde validatie, strengere toegangscontroles, en verbeterde geheugen- en state managementmechanismen.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Apple heeft updates uitgebracht voor iOS en iPadOS om deze kwetsbaarheden te verhelpen. Gebruikers wordt geadviseerd deze updates te installeren om de beveiliging en stabiliteit van hun systemen te waarborgen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Input Validation",
        "title": "CWE-20"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive Information to an Unauthorized Actor",
        "title": "CWE-200"
      },
      {
        "category": "general",
        "text": "Exposure of Private Personal Information to an Unauthorized Actor",
        "title": "CWE-359"
      },
      {
        "category": "general",
        "text": "Improper Resource Shutdown or Release",
        "title": "CWE-404"
      },
      {
        "category": "general",
        "text": "Allocation of Resources Without Limits or Throttling",
        "title": "CWE-770"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Write",
        "title": "CWE-787"
      },
      {
        "category": "general",
        "text": "Buffer Access with Incorrect Length Value",
        "title": "CWE-805"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://support.apple.com/en-us/127110"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://support.apple.com/en-us/127111"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://support.apple.com/en-us/127112"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://support.apple.com/en-us/127113"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://support.apple.com/en-us/127114"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Apple iOS en iPadOS",
    "tracking": {
      "current_release_date": "2026-05-12T12:18:59.723533Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0138",
      "initial_release_date": "2026-05-12T12:18:59.723533Z",
      "revision_history": [
        {
          "date": "2026-05-12T12:18:59.723533Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "iOS"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "iPadOS"
          }
        ],
        "category": "vendor",
        "name": "Apple"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-1837",
      "cwe": {
        "id": "CWE-805",
        "name": "Buffer Access with Incorrect Length Value"
      },
      "notes": [
        {
          "category": "other",
          "text": "Buffer Access with Incorrect Length Value",
          "title": "CWE-805"
        },
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        },
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in libjxl and open source code affecting Apple Software allow specially crafted image files to cause uninitialized memory read/write and denial-of-service conditions.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-1837 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-1837.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-1837"
    },
    {
      "cve": "CVE-2026-28819",
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds write vulnerability allowing arbitrary code execution with kernel privileges was fixed by improved bounds checking in iOS 18.7.9, iPadOS 18.7.9, and multiple macOS versions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28819 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28819.json"
        }
      ],
      "title": "CVE-2026-28819"
    },
    {
      "cve": "CVE-2026-28846",
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow vulnerability causing unexpected app termination has been fixed with improved bounds checking across multiple Apple operating systems including iOS 18.7.9, iPadOS 18.7.9, and macOS Sequoia 15.7.7.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28846 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28846.json"
        }
      ],
      "title": "CVE-2026-28846"
    },
    {
      "cve": "CVE-2026-28847",
      "notes": [
        {
          "category": "description",
          "text": "Apple addressed unexpected process crashes caused by malicious web content through improved memory handling in iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28847 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28847.json"
        }
      ],
      "title": "CVE-2026-28847"
    },
    {
      "cve": "CVE-2026-28870",
      "notes": [
        {
          "category": "description",
          "text": "An information leakage vulnerability allowing unauthorized access to sensitive user data was fixed by implementing additional validation across multiple Apple operating systems including iOS 18.7.9, iPadOS 18.7.9, and macOS Tahoe 26.4.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28870 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28870.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-28870"
    },
    {
      "cve": "CVE-2026-28872",
      "notes": [
        {
          "category": "description",
          "text": "A resource exhaustion vulnerability in iOS and iPadOS versions 18.7.9 and 26.4 was mitigated through improved input validation to prevent denial-of-service attacks by remote attackers.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28872 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28872.json"
        }
      ],
      "title": "CVE-2026-28872"
    },
    {
      "cve": "CVE-2026-28873",
      "notes": [
        {
          "category": "description",
          "text": "An issue in iOS 18.7.9, iPadOS 18.7.9, iOS 26.4, and iPadOS 26.4 allowed apps to bypass App Privacy Report logging, which was resolved by implementing additional entitlement checks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28873 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28873.json"
        }
      ],
      "title": "CVE-2026-28873"
    },
    {
      "cve": "CVE-2026-28877",
      "notes": [
        {
          "category": "description",
          "text": "An authorization vulnerability allowing unauthorized access to sensitive user data was resolved through enhanced state management across multiple Apple operating systems including iOS, iPadOS, macOS, visionOS, and watchOS.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28877 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28877.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-28877"
    },
    {
      "cve": "CVE-2026-28882",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability allowing apps to enumerate a user\u0027s installed applications was addressed through enhanced verification checks across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28882 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28882.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-28882"
    },
    {
      "cve": "CVE-2026-28883",
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free vulnerability causing potential process crashes when processing malicious web content was fixed in iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS 26.5 through improved memory management.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28883 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28883.json"
        }
      ],
      "title": "CVE-2026-28883"
    },
    {
      "cve": "CVE-2026-28894",
      "notes": [
        {
          "category": "description",
          "text": "A denial-of-service vulnerability in iOS 26.4, iPadOS 26.4, and multiple macOS versions was mitigated by improved input validation to prevent remote attackers from causing service disruption.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28894 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28894.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-28894"
    },
    {
      "cve": "CVE-2026-28897",
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow vulnerability in multiple Apple OS versions was fixed by enhancing input validation to prevent local users from causing unexpected system termination or accessing kernel memory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28897 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28897.json"
        }
      ],
      "title": "CVE-2026-28897"
    },
    {
      "cve": "CVE-2026-28901",
      "notes": [
        {
          "category": "description",
          "text": "An issue causing unexpected process crashes when processing maliciously crafted web content was resolved through improved memory handling in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28901 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28901.json"
        }
      ],
      "title": "CVE-2026-28901"
    },
    {
      "cve": "CVE-2026-28902",
      "notes": [
        {
          "category": "description",
          "text": "An issue causing unexpected process crashes when processing maliciously crafted web content was resolved through improved memory handling in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28902 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28902.json"
        }
      ],
      "title": "CVE-2026-28902"
    },
    {
      "cve": "CVE-2026-28903",
      "notes": [
        {
          "category": "description",
          "text": "Apple addressed unexpected process crashes caused by malicious web content through improved memory handling in iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28903 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28903.json"
        }
      ],
      "title": "CVE-2026-28903"
    },
    {
      "cve": "CVE-2026-28904",
      "notes": [
        {
          "category": "description",
          "text": "Apple addressed unexpected process crashes caused by malicious web content through improved memory handling in iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28904 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28904.json"
        }
      ],
      "title": "CVE-2026-28904"
    },
    {
      "cve": "CVE-2026-28905",
      "notes": [
        {
          "category": "description",
          "text": "An issue causing unexpected process crashes when handling malicious web content was resolved through improved memory management in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, and visionOS 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28905 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28905.json"
        }
      ],
      "title": "CVE-2026-28905"
    },
    {
      "cve": "CVE-2026-28906",
      "notes": [
        {
          "category": "description",
          "text": "An IP address tracking vulnerability affecting multiple Apple operating systems was resolved through improved state management in versions including iOS 18.7.9, iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, and visionOS 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28906 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28906.json"
        }
      ],
      "title": "CVE-2026-28906"
    },
    {
      "cve": "CVE-2026-28907",
      "notes": [
        {
          "category": "description",
          "text": "An input validation flaw allowing Content Security Policy enforcement bypass was resolved in iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28907 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28907.json"
        }
      ],
      "title": "CVE-2026-28907"
    },
    {
      "cve": "CVE-2026-28913",
      "notes": [
        {
          "category": "description",
          "text": "An issue causing unexpected process crashes due to maliciously crafted web content was resolved by improved memory handling in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, and watchOS 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28913 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28913.json"
        }
      ],
      "title": "CVE-2026-28913"
    },
    {
      "cve": "CVE-2026-28917",
      "notes": [
        {
          "category": "description",
          "text": "An input validation flaw causing unexpected process crashes when handling malicious web content was resolved in multiple Apple operating systems including iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS versions 18.7.9 and 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28917 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28917.json"
        }
      ],
      "title": "CVE-2026-28917"
    },
    {
      "cve": "CVE-2026-28918",
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds access vulnerability was addressed by enhancing bounds checking to prevent unexpected application termination when parsing maliciously crafted files across multiple Apple operating systems.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28918 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28918.json"
        }
      ],
      "title": "CVE-2026-28918"
    },
    {
      "cve": "CVE-2026-28920",
      "notes": [
        {
          "category": "description",
          "text": "An information leakage vulnerability caused by visiting malicious websites was addressed through additional validation in multiple Apple operating systems including iOS 18.7.9, iPadOS 18.7.9, and macOS Sequoia 15.7.7.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28920 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28920.json"
        }
      ],
      "title": "CVE-2026-28920"
    },
    {
      "cve": "CVE-2026-28929",
      "notes": [
        {
          "category": "description",
          "text": "A logic flaw causing remote images to display when replying to emails in Mail\u0027s Lockdown Mode was fixed with enhanced checks in iOS 18.7.9, iPadOS 18.7.9, and multiple macOS versions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28929 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28929.json"
        }
      ],
      "title": "CVE-2026-28929"
    },
    {
      "cve": "CVE-2026-28936",
      "notes": [
        {
          "category": "description",
          "text": "An issue causing unexpected application termination when processing maliciously crafted files was resolved through enhanced validation checks in multiple Apple operating systems including iOS, iPadOS, macOS, and visionOS.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28936 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28936.json"
        }
      ],
      "title": "CVE-2026-28936"
    },
    {
      "cve": "CVE-2026-28940",
      "notes": [
        {
          "category": "description",
          "text": "A memory corruption vulnerability triggered by processing maliciously crafted images was addressed through enhanced memory handling across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, and visionOS versions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28940 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28940.json"
        }
      ],
      "title": "CVE-2026-28940"
    },
    {
      "cve": "CVE-2026-28941",
      "notes": [
        {
          "category": "description",
          "text": "Apple has addressed a denial-of-service and potential memory disclosure vulnerability caused by processing malicious files through enhanced validation in iOS 18.7.9, iPadOS 18.7.9, macOS Sequoia 15.7.7, and macOS Tahoe 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28941 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28941.json"
        }
      ],
      "title": "CVE-2026-28941"
    },
    {
      "cve": "CVE-2026-28942",
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free vulnerability in Safari causing unexpected crashes when processing malicious web content was fixed via improved memory management in iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS version 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28942 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28942.json"
        }
      ],
      "title": "CVE-2026-28942"
    },
    {
      "cve": "CVE-2026-28943",
      "notes": [
        {
          "category": "description",
          "text": "A logging issue was fixed by enhancing data redaction across multiple OS versions to prevent applications from determining the kernel memory layout.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28943 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28943.json"
        }
      ],
      "title": "CVE-2026-28943"
    },
    {
      "cve": "CVE-2026-28944",
      "notes": [
        {
          "category": "description",
          "text": "A memory handling flaw causing unexpected process crashes when processing malicious web content was resolved in iOS 16.5, iPadOS 16.5, macOS Tahoe 16.5, and visionOS 16.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28944 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28944.json"
        }
      ],
      "title": "CVE-2026-28944"
    },
    {
      "cve": "CVE-2026-28947",
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free vulnerability in Safari causing unexpected crashes when processing malicious web content was fixed via improved memory management in iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS version 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28947 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28947.json"
        }
      ],
      "title": "CVE-2026-28947"
    },
    {
      "cve": "CVE-2026-28950",
      "cwe": {
        "id": "CWE-359",
        "name": "Exposure of Private Personal Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Private Personal Information to an Unauthorized Actor",
          "title": "CWE-359"
        },
        {
          "category": "description",
          "text": "A logging issue causing notifications marked for deletion to be unexpectedly retained on iOS and iPadOS devices was resolved by enhancing data redaction across multiple versions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28950 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28950.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2"
          ]
        }
      ],
      "title": "CVE-2026-28950"
    },
    {
      "cve": "CVE-2026-28951",
      "notes": [
        {
          "category": "description",
          "text": "An authorization vulnerability allowing an app to gain root privileges was resolved through improved state management across multiple Apple operating systems including iOS 18.7.9, iPadOS 18.7.9, and various macOS versions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28951 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28951.json"
        }
      ],
      "title": "CVE-2026-28951"
    },
    {
      "cve": "CVE-2026-28952",
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow vulnerability in iOS 18.7.9, iPadOS 18.7.9, and multiple macOS versions was fixed by enhancing input validation to prevent apps from causing unexpected system termination.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28952 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28952.json"
        }
      ],
      "title": "CVE-2026-28952"
    },
    {
      "cve": "CVE-2026-28953",
      "notes": [
        {
          "category": "description",
          "text": "Apple addressed unexpected process crashes caused by malicious web content through improved memory handling in iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28953 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28953.json"
        }
      ],
      "title": "CVE-2026-28953"
    },
    {
      "cve": "CVE-2026-28954",
      "notes": [
        {
          "category": "description",
          "text": "A file quarantine bypass vulnerability in iOS 18.7.9, iPadOS 18.7.9, and multiple macOS versions was fixed by adding additional checks to prevent malicious disk images from bypassing Gatekeeper.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28954 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28954.json"
        }
      ],
      "title": "CVE-2026-28954"
    },
    {
      "cve": "CVE-2026-28955",
      "notes": [
        {
          "category": "description",
          "text": "Apple addressed unexpected process crashes caused by malicious web content through improved memory handling in iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28955 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28955.json"
        }
      ],
      "title": "CVE-2026-28955"
    },
    {
      "cve": "CVE-2026-28956",
      "notes": [
        {
          "category": "description",
          "text": "A memory corruption vulnerability caused by processing malicious media files was fixed through improved input validation in multiple Apple OS versions, including iOS 16.5 and macOS Sequoia 15.7.7, preventing app crashes and memory corruption.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28956 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28956.json"
        }
      ],
      "title": "CVE-2026-28956"
    },
    {
      "cve": "CVE-2026-28957",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability allowing applications to capture user screen content via camera metadata was addressed in iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, and visionOS 26.5 through enhanced logic controls.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28957 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28957.json"
        }
      ],
      "title": "CVE-2026-28957"
    },
    {
      "cve": "CVE-2026-28958",
      "notes": [
        {
          "category": "description",
          "text": "Apple fixed a vulnerability in iOS 16.5, iPadOS 16.5, macOS Sonoma 14.5, and visionOS 16.5 that previously allowed apps to access sensitive user data by enhancing data protection mechanisms.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28958 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28958.json"
        }
      ],
      "title": "CVE-2026-28958"
    },
    {
      "cve": "CVE-2026-28959",
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow vulnerability affecting multiple OS versions was fixed by enhancing bounds checking to prevent applications from causing unexpected system termination.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28959 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28959.json"
        }
      ],
      "title": "CVE-2026-28959"
    },
    {
      "cve": "CVE-2026-28962",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability allowing disclosure of sensitive user information via malicious web content was addressed by enhanced access restrictions in iOS 18.7.9, iPadOS 18.7.9, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, and visionOS 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28962 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28962.json"
        }
      ],
      "title": "CVE-2026-28962"
    },
    {
      "cve": "CVE-2026-28963",
      "notes": [
        {
          "category": "description",
          "text": "A privacy vulnerability in iOS 26.5 and iPadOS 26.5 allowed attackers with physical access to exploit Visual Intelligence during iPhone Mirroring to access sensitive data, which was remediated by removing the vulnerable code.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28963 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28963.json"
        }
      ],
      "title": "CVE-2026-28963"
    },
    {
      "cve": "CVE-2026-28964",
      "notes": [
        {
          "category": "description",
          "text": "An inconsistent user interface issue in iOS 16.5, iPadOS 16.5, and visionOS 16.5 that could allow an app to access sensitive user data was resolved through improved state management.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28964 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28964.json"
        }
      ],
      "title": "CVE-2026-28964"
    },
    {
      "cve": "CVE-2026-28965",
      "notes": [
        {
          "category": "description",
          "text": "A privacy vulnerability in iOS 26.5 and iPadOS 26.5 that allowed users to access restricted content from the lock screen has been addressed through enhanced verification mechanisms.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28965 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28965.json"
        }
      ],
      "title": "CVE-2026-28965"
    },
    {
      "cve": "CVE-2026-28969",
      "notes": [
        {
          "category": "description",
          "text": "A use after free vulnerability was fixed through improved memory management in multiple Apple operating systems, including iOS 18.7.9 and macOS Sequoia 15.7.7, preventing unexpected system termination caused by apps.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28969 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28969.json"
        }
      ],
      "title": "CVE-2026-28969"
    },
    {
      "cve": "CVE-2026-28971",
      "notes": [
        {
          "category": "description",
          "text": "A malicious iframe exploiting download settings was addressed by improved UI handling and fixed in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, and visionOS 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28971 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28971.json"
        }
      ],
      "title": "CVE-2026-28971"
    },
    {
      "cve": "CVE-2026-28972",
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds write vulnerability affecting multiple Apple operating systems was fixed by improved input validation to prevent apps from causing unexpected system termination or writing kernel memory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28972 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28972.json"
        }
      ],
      "title": "CVE-2026-28972"
    },
    {
      "cve": "CVE-2026-28974",
      "notes": [
        {
          "category": "description",
          "text": "An issue causing denial-of-service was resolved through enhanced validation checks in iOS 26.5, iPadOS 26.5, macOS Sequoia 15.7.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28974 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28974.json"
        }
      ],
      "title": "CVE-2026-28974"
    },
    {
      "cve": "CVE-2026-28977",
      "notes": [
        {
          "category": "description",
          "text": "Improved bounds checks resolved an issue causing unexpected application termination when processing maliciously crafted files across multiple Apple operating systems including iOS 18.7.9, iPadOS 18.7.9, and macOS Sequoia 15.7.7.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28977 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28977.json"
        }
      ],
      "title": "CVE-2026-28977"
    },
    {
      "cve": "CVE-2026-28983",
      "notes": [
        {
          "category": "description",
          "text": "A type confusion vulnerability was addressed with enhanced validation checks in multiple operating systems, including iOS 18.7.9 and macOS Tahoe 26.5, preventing remote attackers from causing denial of service conditions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28983 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28983.json"
        }
      ],
      "title": "CVE-2026-28983"
    },
    {
      "cve": "CVE-2026-28985",
      "notes": [
        {
          "category": "description",
          "text": "A null pointer dereference vulnerability in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, and tvOS 26.5 was fixed by improving input validation to prevent local network attackers from causing denial-of-service conditions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28985 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28985.json"
        }
      ],
      "title": "CVE-2026-28985"
    },
    {
      "cve": "CVE-2026-28986",
      "notes": [
        {
          "category": "description",
          "text": "A race condition vulnerability was resolved through additional validation across multiple OS versions to prevent applications from causing unexpected system termination.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28986 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28986.json"
        }
      ],
      "title": "CVE-2026-28986"
    },
    {
      "cve": "CVE-2026-28987",
      "notes": [
        {
          "category": "description",
          "text": "A logging issue in multiple Apple operating systems, including iOS 18.7.9 and macOS Sequoia 15.7.7, was fixed by improving data redaction to prevent apps from leaking sensitive kernel state information.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28987 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28987.json"
        }
      ],
      "title": "CVE-2026-28987"
    },
    {
      "cve": "CVE-2026-28988",
      "notes": [
        {
          "category": "description",
          "text": "A permissions vulnerability allowing apps to bypass certain Privacy preferences was resolved with additional restrictions in iOS 16.5, iPadOS 16.5, macOS Sonoma 16.5, visionOS 16.5, and watchOS 16.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28988 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28988.json"
        }
      ],
      "title": "CVE-2026-28988"
    },
    {
      "cve": "CVE-2026-28990",
      "notes": [
        {
          "category": "description",
          "text": "A memory corruption vulnerability caused by processing a maliciously crafted image was resolved through improved memory handling across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28990 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28990.json"
        }
      ],
      "title": "CVE-2026-28990"
    },
    {
      "cve": "CVE-2026-28991",
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read vulnerability in iOS 26.5 and related OS versions was fixed by implementing improved bounds checking to prevent potential denial-of-service attacks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28991 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28991.json"
        }
      ],
      "title": "CVE-2026-28991"
    },
    {
      "cve": "CVE-2026-28992",
      "notes": [
        {
          "category": "description",
          "text": "A memory corruption vulnerability in multiple Apple operating systems was fixed by enhancing locking mechanisms to prevent attackers from causing unexpected application termination.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28992 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28992.json"
        }
      ],
      "title": "CVE-2026-28992"
    },
    {
      "cve": "CVE-2026-28993",
      "notes": [
        {
          "category": "description",
          "text": "An issue where apps could access user-sensitive data was addressed by introducing an additional user consent prompt across multiple OS versions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28993 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28993.json"
        }
      ],
      "title": "CVE-2026-28993"
    },
    {
      "cve": "CVE-2026-28994",
      "notes": [
        {
          "category": "description",
          "text": "A use after free vulnerability in Wi-Fi packet processing, exploitable by attackers in privileged network positions to cause denial-of-service, was fixed through improved memory management in multiple Apple OS versions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28994 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28994.json"
        }
      ],
      "title": "CVE-2026-28994"
    },
    {
      "cve": "CVE-2026-28995",
      "notes": [
        {
          "category": "description",
          "text": "A logic issue was resolved by implementing enhanced restrictions across multiple Apple OS versions to prevent malicious applications from escaping their sandbox environments.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28995 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28995.json"
        }
      ],
      "title": "CVE-2026-28995"
    },
    {
      "cve": "CVE-2026-28996",
      "notes": [
        {
          "category": "description",
          "text": "A race condition vulnerability allowing unauthorized app access to sensitive user data was fixed with additional validation across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28996 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28996.json"
        }
      ],
      "title": "CVE-2026-28996"
    },
    {
      "cve": "CVE-2026-39869",
      "notes": [
        {
          "category": "description",
          "text": "A memory handling flaw causing process termination when processing malicious audio streams was fixed across multiple Apple OS versions including iOS 18.7.9, iPadOS 18.7.9, and macOS Sequoia 15.7.7.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-39869 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-39869.json"
        }
      ],
      "title": "CVE-2026-39869"
    },
    {
      "cve": "CVE-2026-43653",
      "notes": [
        {
          "category": "description",
          "text": "A denial-of-service vulnerability exploitable by a local network attacker was fixed through improved memory handling in multiple Apple operating systems including iOS 18.7.9, iPadOS 18.7.9, and macOS Sonoma 14.8.7.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-43653 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43653.json"
        }
      ],
      "title": "CVE-2026-43653"
    },
    {
      "cve": "CVE-2026-43654",
      "notes": [
        {
          "category": "description",
          "text": "A kernel memory disclosure vulnerability was resolved through enhanced memory handling across multiple Apple operating systems including iOS 18.7.9, iPadOS 18.7.9, and macOS Sequoia 15.7.7.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-43654 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43654.json"
        }
      ],
      "title": "CVE-2026-43654"
    },
    {
      "cve": "CVE-2026-43655",
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read vulnerability was addressed through enhanced bounds checking in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, and watchOS 26.5 to prevent unexpected system termination and unauthorized kernel memory access.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-43655 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43655.json"
        }
      ],
      "title": "CVE-2026-43655"
    },
    {
      "cve": "CVE-2026-43656",
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds write vulnerability in iOS, iPadOS, and macOS caused by parsing maliciously crafted files was fixed by improving input validation to prevent unexpected application termination.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-43656 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43656.json"
        }
      ],
      "title": "CVE-2026-43656"
    },
    {
      "cve": "CVE-2026-43658",
      "notes": [
        {
          "category": "description",
          "text": "A memory handling flaw causing Safari to crash when processing malicious web content was resolved in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-43658 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43658.json"
        }
      ],
      "title": "CVE-2026-43658"
    },
    {
      "cve": "CVE-2026-43659",
      "notes": [
        {
          "category": "description",
          "text": "A race condition vulnerability was addressed through additional validation in multiple OS versions, including iOS 18.7.9 and macOS Sequoia 15.7.7, preventing unauthorized access to sensitive user data by applications.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-43659 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43659.json"
        }
      ],
      "title": "CVE-2026-43659"
    },
    {
      "cve": "CVE-2026-43660",
      "notes": [
        {
          "category": "description",
          "text": "Apple has fixed a validation issue in iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS that could allow malicious web content to bypass Content Security Policy enforcement in their 26.5 and 18.7.9 updates.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-43660 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43660.json"
        }
      ],
      "title": "CVE-2026-43660"
    },
    {
      "cve": "CVE-2026-43661",
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow vulnerability in iOS, iPadOS, macOS Tahoe, tvOS, and watchOS 26.5 was fixed by enhancing memory handling to prevent process memory corruption from maliciously crafted images.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-43661 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43661.json"
        }
      ],
      "title": "CVE-2026-43661"
    },
    {
      "cve": "CVE-2026-43666",
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds write vulnerability in multiple Apple operating systems, including iOS 18.7.9, iPadOS 18.7.9, and macOS Sequoia 15.7.7, was fixed by improved bounds checking to prevent local network denial-of-service attacks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-43666 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43666.json"
        }
      ],
      "title": "CVE-2026-43666"
    },
    {
      "cve": "CVE-2026-43668",
      "notes": [
        {
          "category": "description",
          "text": "A use after free vulnerability in multiple Apple OS versions, including iOS 18.7.9 and macOS Sequoia 15.7.7, could allow a remote attacker to cause unexpected system termination or kernel memory corruption.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-43668 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43668.json"
        }
      ],
      "title": "CVE-2026-43668"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Apple heeft meerdere kwetsbaarheden verholpen in macOS (Specifiek voor Sequoia 15.7.5, Sonoma 14.8.5, en Tahoe 26.4).",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden omvatten verschillende problemen zoals onvoldoende validatie van invoer, onjuiste afhandeling van geheugen, en problemen met machtigingen die konden leiden tot ongeautoriseerde toegang tot gevoelige gebruikersdata. Aanvallers kunnen deze kwetsbaarheden misbruiken om toegang te krijgen tot beschermde systeembestanden, gegevens te wijzigen, of zelfs de stabiliteit van het systeem in gevaar te brengen. De kwetsbaarheden zijn opgelost door verbeterde validatie- en beveiligingsmechanismen in de betrokken macOS-versies.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Apple heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Input Validation",
        "title": "CWE-20"
      },
      {
        "category": "general",
        "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
        "title": "CWE-22"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
        "title": "CWE-77"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
        "title": "CWE-79"
      },
      {
        "category": "general",
        "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
        "title": "CWE-119"
      },
      {
        "category": "general",
        "text": "Heap-based Buffer Overflow",
        "title": "CWE-122"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Read",
        "title": "CWE-125"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Escape, Meta, or Control Sequences",
        "title": "CWE-150"
      },
      {
        "category": "general",
        "text": "Integer Overflow or Wraparound",
        "title": "CWE-190"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive Information to an Unauthorized Actor",
        "title": "CWE-200"
      },
      {
        "category": "general",
        "text": "Insertion of Sensitive Information Into Sent Data",
        "title": "CWE-201"
      },
      {
        "category": "general",
        "text": "Privilege Issues",
        "title": "CWE-265"
      },
      {
        "category": "general",
        "text": "Permission Issues",
        "title": "CWE-275"
      },
      {
        "category": "general",
        "text": "Improper Access Control",
        "title": "CWE-284"
      },
      {
        "category": "general",
        "text": "Improper Authorization",
        "title": "CWE-285"
      },
      {
        "category": "general",
        "text": "Improper Authentication",
        "title": "CWE-287"
      },
      {
        "category": "general",
        "text": "Authentication Bypass Using an Alternate Path or Channel",
        "title": "CWE-288"
      },
      {
        "category": "general",
        "text": "Authentication Bypass by Primary Weakness",
        "title": "CWE-305"
      },
      {
        "category": "general",
        "text": "Origin Validation Error",
        "title": "CWE-346"
      },
      {
        "category": "general",
        "text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
        "title": "CWE-362"
      },
      {
        "category": "general",
        "text": "State Issues",
        "title": "CWE-371"
      },
      {
        "category": "general",
        "text": "Insecure Temporary File",
        "title": "CWE-377"
      },
      {
        "category": "general",
        "text": "Improper Resource Shutdown or Release",
        "title": "CWE-404"
      },
      {
        "category": "general",
        "text": "Use After Free",
        "title": "CWE-416"
      },
      {
        "category": "general",
        "text": "NULL Pointer Dereference",
        "title": "CWE-476"
      },
      {
        "category": "general",
        "text": "Insufficiently Protected Credentials",
        "title": "CWE-522"
      },
      {
        "category": "general",
        "text": "Insertion of Sensitive Information into Log File",
        "title": "CWE-532"
      },
      {
        "category": "general",
        "text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
        "title": "CWE-601"
      },
      {
        "category": "general",
        "text": "Server-Side Request Forgery (SSRF)",
        "title": "CWE-918"
      },
      {
        "category": "general",
        "text": "Permissive Cross-domain Security Policy with Untrusted Domains",
        "title": "CWE-942"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://support.apple.com/en-us/126794"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://support.apple.com/en-us/126795"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://support.apple.com/en-us/126796"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Apple macOS",
    "tracking": {
      "current_release_date": "2026-03-25T14:15:56.073353Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0102",
      "initial_release_date": "2026-03-25T14:15:56.073353Z",
      "revision_history": [
        {
          "date": "2026-03-25T14:15:56.073353Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Mac OS"
          }
        ],
        "category": "vendor",
        "name": "Apple"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14524",
      "cwe": {
        "id": "CWE-522",
        "name": "Insufficiently Protected Credentials"
      },
      "notes": [
        {
          "category": "other",
          "text": "Insufficiently Protected Credentials",
          "title": "CWE-522"
        },
        {
          "category": "other",
          "text": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
          "title": "CWE-601"
        },
        {
          "category": "description",
          "text": "A vulnerability in libcurl versions 7.33.0 to 8.17.0 causes OAuth2 bearer tokens to be unintentionally leaked during cross-protocol redirects involving IMAP, LDAP, POP3, or SMTP schemes, potentially exposing sensitive information.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-14524 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-14524.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2025-14524"
    },
    {
      "cve": "CVE-2025-55753",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "other",
          "text": "Integer Overflow or Wraparound",
          "title": "CWE-190"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities affect Oracle Communications Unified Assurance and Apache HTTP Server, including critical data compromise, denial of service, and issues in mod_md (ACME) components across various versions.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-55753 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55753.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2025-55753"
    },
    {
      "cve": "CVE-2025-58098",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "notes": [
        {
          "category": "other",
          "text": "Insertion of Sensitive Information Into Sent Data",
          "title": "CWE-201"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities affect Oracle Communications Unified Assurance (6.1.0-6.1.1) and Apache HTTP Server (pre-2.4.66), including issues with Server Side Includes, mod_cgid, mod_md, and mod_userdir+suexec, leading to data compromise, denial of service, and information disclosure.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-58098 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-58098.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2025-58098"
    },
    {
      "cve": "CVE-2025-59775",
      "cwe": {
        "id": "CWE-918",
        "name": "Server-Side Request Forgery (SSRF)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Server-Side Request Forgery (SSRF)",
          "title": "CWE-918"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities affect Oracle Secure Backup and Apache HTTP Server, including unauthorized data modification, SSRF leading to NTLM hash leakage, and sensitive information disclosure across various versions and configurations.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-59775 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-59775.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2025-59775"
    },
    {
      "cve": "CVE-2025-64505",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities in libpng, including heap buffer overflows and over-reads in functions like png_do_quantize, affect various products including NetApp and Apple software, alongside a separate Oracle MySQL Workbench flaw allowing unauthorized data modification or denial of service.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-64505 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-64505.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2025-64505"
    },
    {
      "cve": "CVE-2025-65082",
      "cwe": {
        "id": "CWE-150",
        "name": "Improper Neutralization of Escape, Meta, or Control Sequences"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Escape, Meta, or Control Sequences",
          "title": "CWE-150"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities affect Oracle Communications Unified Assurance (6.1.0-6.1.1) and Apache HTTP Server (2.4.0-2.4.65), including CGI environment variable overrides, improper neutralization of environment variables, and other security issues leading to data compromise and denial of service.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-65082 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-65082.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2025-65082"
    },
    {
      "cve": "CVE-2025-66200",
      "cwe": {
        "id": "CWE-288",
        "name": "Authentication Bypass Using an Alternate Path or Channel"
      },
      "notes": [
        {
          "category": "other",
          "text": "Authentication Bypass Using an Alternate Path or Channel",
          "title": "CWE-288"
        },
        {
          "category": "other",
          "text": "Authentication Bypass by Primary Weakness",
          "title": "CWE-305"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities affect Oracle Communications Unified Assurance (6.1.0-6.1.1) and Apache HTTP Server (2.4.7-2.4.65), including privilege escalation, mod_userdir+suexec bypass, and information disclosure issues.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-66200 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-66200.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2025-66200"
    },
    {
      "cve": "CVE-2026-20607",
      "notes": [
        {
          "category": "description",
          "text": "macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4 addressed a permissions issue by implementing additional restrictions to prevent apps from accessing protected user data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20607 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20607.json"
        }
      ],
      "title": "CVE-2026-20607"
    },
    {
      "cve": "CVE-2026-20631",
      "notes": [
        {
          "category": "description",
          "text": "An elevation of privilege vulnerability in macOS Tahoe 26.4 was addressed by implementing enhanced logic checks to prevent unauthorized privilege escalation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20631 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20631.json"
        }
      ],
      "title": "CVE-2026-20631"
    },
    {
      "cve": "CVE-2026-20632",
      "notes": [
        {
          "category": "description",
          "text": "macOS Tahoe 26.4 fixed a parsing vulnerability in directory path handling that previously allowed applications to access sensitive user data by enhancing path validation mechanisms.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20632 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20632.json"
        }
      ],
      "title": "CVE-2026-20632"
    },
    {
      "cve": "CVE-2026-20633",
      "notes": [
        {
          "category": "description",
          "text": "macOS versions Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4 fixed a security issue involving symlink handling that previously allowed apps to access user-sensitive data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20633 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20633.json"
        }
      ],
      "title": "CVE-2026-20633"
    },
    {
      "cve": "CVE-2026-20637",
      "notes": [
        {
          "category": "description",
          "text": "A use after free vulnerability causing unexpected system termination was fixed by improving memory management across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20637 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20637.json"
        }
      ],
      "title": "CVE-2026-20637"
    },
    {
      "cve": "CVE-2026-20639",
      "notes": [
        {
          "category": "description",
          "text": "An integer overflow vulnerability causing potential heap corruption from processing maliciously crafted strings was fixed in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.3 by improving input validation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20639 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20639.json"
        }
      ],
      "title": "CVE-2026-20639"
    },
    {
      "cve": "CVE-2026-20643",
      "cwe": {
        "id": "CWE-346",
        "name": "Origin Validation Error"
      },
      "notes": [
        {
          "category": "other",
          "text": "Origin Validation Error",
          "title": "CWE-346"
        },
        {
          "category": "description",
          "text": "Multiple Apple OS updates including Safari, iOS, iPadOS, and macOS addressed a cross-origin vulnerability in the Navigation API by improving input validation to prevent bypassing the Same Origin Policy.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20643 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20643.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-20643"
    },
    {
      "cve": "CVE-2026-20651",
      "notes": [
        {
          "category": "description",
          "text": "A privacy vulnerability related to temporary file handling that allowed unauthorized app access to sensitive user data was resolved in macOS Sequoia 15.7.5, macOS Sonoma 14.8.4, and macOS Tahoe 26.3.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20651 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20651.json"
        }
      ],
      "title": "CVE-2026-20651"
    },
    {
      "cve": "CVE-2026-20657",
      "notes": [
        {
          "category": "description",
          "text": "Improved memory handling in iOS 18.7.7, iPadOS 18.7.7, macOS Sequoia 15.7.5, and macOS Sonoma 14.8.5 fixed an issue where parsing a maliciously crafted file could cause unexpected app termination.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20657 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20657.json"
        }
      ],
      "title": "CVE-2026-20657"
    },
    {
      "cve": "CVE-2026-20660",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "title": "CWE-22"
        },
        {
          "category": "description",
          "text": "A path handling vulnerability allowing remote users to write arbitrary files was fixed in multiple Apple operating systems and Safari versions through improved logic preventing unauthorized file writes.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20660 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20660.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1"
          ]
        }
      ],
      "title": "CVE-2026-20660"
    },
    {
      "cve": "CVE-2026-20664",
      "notes": [
        {
          "category": "description",
          "text": "Improved memory handling in Safari 26.4, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4 fixed an issue where processing maliciously crafted web content could cause unexpected process crashes.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20664 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20664.json"
        }
      ],
      "title": "CVE-2026-20664"
    },
    {
      "cve": "CVE-2026-20665",
      "notes": [
        {
          "category": "description",
          "text": "Apple fixed a vulnerability in multiple operating systems and Safari versions 26.4 and iOS/iPadOS 18.7.7 where malicious web content could bypass Content Security Policy enforcement due to improper state management.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20665 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20665.json"
        }
      ],
      "title": "CVE-2026-20665"
    },
    {
      "cve": "CVE-2026-20668",
      "notes": [
        {
          "category": "description",
          "text": "A logging issue affecting iOS, iPadOS, macOS, and visionOS was fixed by enhancing data redaction to prevent apps from accessing sensitive user information.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20668 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20668.json"
        }
      ],
      "title": "CVE-2026-20668"
    },
    {
      "cve": "CVE-2026-20684",
      "notes": [
        {
          "category": "description",
          "text": "A permissions issue in macOS Tahoe 26.4 was fixed by implementing additional restrictions to prevent an app from bypassing Gatekeeper security checks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20684 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20684.json"
        }
      ],
      "title": "CVE-2026-20684"
    },
    {
      "cve": "CVE-2026-20687",
      "notes": [
        {
          "category": "description",
          "text": "A use after free vulnerability in multiple Apple operating systems was fixed by improving memory management to prevent apps from causing unexpected system termination or writing to kernel memory.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20687 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20687.json"
        }
      ],
      "title": "CVE-2026-20687"
    },
    {
      "cve": "CVE-2026-20688",
      "notes": [
        {
          "category": "description",
          "text": "A path handling vulnerability allowing applications to potentially escape their sandbox was fixed through improved validation in iOS 26.4, iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, and visionOS 26.4.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20688 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20688.json"
        }
      ],
      "title": "CVE-2026-20688"
    },
    {
      "cve": "CVE-2026-20690",
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds access vulnerability in Apple operating systems was fixed by improving bounds checking to prevent process termination caused by maliciously crafted audio streams.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20690 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20690.json"
        }
      ],
      "title": "CVE-2026-20690"
    },
    {
      "cve": "CVE-2026-20691",
      "notes": [
        {
          "category": "description",
          "text": "An authorization vulnerability in Safari 26.4 and related OS versions was resolved by enhancing state management to prevent malicious webpages from fingerprinting users.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20691 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20691.json"
        }
      ],
      "title": "CVE-2026-20691"
    },
    {
      "cve": "CVE-2026-20692",
      "notes": [
        {
          "category": "description",
          "text": "A privacy issue affecting user preferences for mail content handling, specifically the \u0027Hide IP Address\u0027 and \u0027Block All Remote Content\u0027 features, was fixed in iOS 26.4, iPadOS 26.4, and various macOS versions.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20692 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20692.json"
        }
      ],
      "title": "CVE-2026-20692"
    },
    {
      "cve": "CVE-2026-20693",
      "notes": [
        {
          "category": "description",
          "text": "An issue allowing an attacker with root privileges to delete protected system files was resolved through improved state management in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20693 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20693.json"
        }
      ],
      "title": "CVE-2026-20693"
    },
    {
      "cve": "CVE-2026-20694",
      "notes": [
        {
          "category": "description",
          "text": "Multiple versions of iOS, iPadOS, and macOS addressed a vulnerability involving improper handling of symlinks that could allow an app to access user-sensitive data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20694 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20694.json"
        }
      ],
      "title": "CVE-2026-20694"
    },
    {
      "cve": "CVE-2026-20695",
      "notes": [
        {
          "category": "description",
          "text": "An information disclosure vulnerability allowing applications to determine kernel memory layout was fixed by improving memory management in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20695 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20695.json"
        }
      ],
      "title": "CVE-2026-20695"
    },
    {
      "cve": "CVE-2026-20697",
      "notes": [
        {
          "category": "description",
          "text": "macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4 addressed a permissions issue by implementing additional restrictions to prevent apps from accessing sensitive user data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20697 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20697.json"
        }
      ],
      "title": "CVE-2026-20697"
    },
    {
      "cve": "CVE-2026-20698",
      "notes": [
        {
          "category": "description",
          "text": "A memory handling vulnerability in iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4 could allow an app to cause unexpected system termination or kernel memory corruption, which was resolved through improved memory management.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20698 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20698.json"
        }
      ],
      "title": "CVE-2026-20698"
    },
    {
      "cve": "CVE-2026-20699",
      "notes": [
        {
          "category": "description",
          "text": "A downgrade vulnerability on Intel-based Macs allowing potential access to user-sensitive data was mitigated by enhanced code-signing restrictions in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.3/26.4.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20699 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20699.json"
        }
      ],
      "title": "CVE-2026-20699"
    },
    {
      "cve": "CVE-2026-20701",
      "notes": [
        {
          "category": "description",
          "text": "macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4 addressed an access issue by implementing additional sandbox restrictions to prevent apps from connecting to network shares without user consent.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-20701 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20701.json"
        }
      ],
      "title": "CVE-2026-20701"
    },
    {
      "cve": "CVE-2026-28816",
      "notes": [
        {
          "category": "description",
          "text": "A path handling vulnerability allowing unauthorized file deletion was fixed through improved validation in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28816 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28816.json"
        }
      ],
      "title": "CVE-2026-28816"
    },
    {
      "cve": "CVE-2026-28817",
      "notes": [
        {
          "category": "description",
          "text": "A race condition vulnerability allowing sandboxed processes to bypass restrictions was fixed by improving state handling in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28817 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28817.json"
        }
      ],
      "title": "CVE-2026-28817"
    },
    {
      "cve": "CVE-2026-28818",
      "notes": [
        {
          "category": "description",
          "text": "A logging issue allowing apps to access sensitive user data was fixed through improved data redaction in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28818 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28818.json"
        }
      ],
      "title": "CVE-2026-28818"
    },
    {
      "cve": "CVE-2026-28820",
      "notes": [
        {
          "category": "description",
          "text": "macOS Tahoe 26.4 addressed a security issue by implementing enhanced validation checks to prevent unauthorized app access to sensitive user data.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28820 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28820.json"
        }
      ],
      "title": "CVE-2026-28820"
    },
    {
      "cve": "CVE-2026-28821",
      "notes": [
        {
          "category": "description",
          "text": "A validation issue in entitlement verification that could allow an app to gain elevated privileges was fixed in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4 through improved process entitlement validation.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28821 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28821.json"
        }
      ],
      "title": "CVE-2026-28821"
    },
    {
      "cve": "CVE-2026-28822",
      "notes": [
        {
          "category": "description",
          "text": "A type confusion vulnerability related to memory handling in multiple Apple operating systems could allow an attacker to cause unexpected application termination.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28822 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28822.json"
        }
      ],
      "title": "CVE-2026-28822"
    },
    {
      "cve": "CVE-2026-28823",
      "notes": [
        {
          "category": "description",
          "text": "A path handling vulnerability in macOS Tahoe 26.4 allowed applications with root privileges to delete protected system files, which was resolved through improved validation mechanisms.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28823 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28823.json"
        }
      ],
      "title": "CVE-2026-28823"
    },
    {
      "cve": "CVE-2026-28824",
      "notes": [
        {
          "category": "description",
          "text": "An authorization vulnerability allowing applications to access sensitive user data was resolved by enhancing state management in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28824 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28824.json"
        }
      ],
      "title": "CVE-2026-28824"
    },
    {
      "cve": "CVE-2026-28825",
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds write vulnerability allowing applications to modify protected file system areas was fixed by improving bounds checking in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28825 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28825.json"
        }
      ],
      "title": "CVE-2026-28825"
    },
    {
      "cve": "CVE-2026-28826",
      "notes": [
        {
          "category": "description",
          "text": "A logic flaw in macOS Tahoe 26.4 allowed a malicious application to escape its sandbox, which was addressed by implementing enhanced sandbox restrictions.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28826 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28826.json"
        }
      ],
      "title": "CVE-2026-28826"
    },
    {
      "cve": "CVE-2026-28827",
      "notes": [
        {
          "category": "description",
          "text": "A parsing vulnerability in directory path handling that could allow an application to escape its sandbox was fixed through enhanced path validation in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28827 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28827.json"
        }
      ],
      "title": "CVE-2026-28827"
    },
    {
      "cve": "CVE-2026-28828",
      "notes": [
        {
          "category": "description",
          "text": "A permissions vulnerability allowing applications to access sensitive user data was fixed by removing the vulnerable code in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28828 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28828.json"
        }
      ],
      "title": "CVE-2026-28828"
    },
    {
      "cve": "CVE-2026-28829",
      "notes": [
        {
          "category": "description",
          "text": "macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4 addressed a permissions issue by implementing additional restrictions to prevent applications from modifying protected parts of the file system.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28829 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28829.json"
        }
      ],
      "title": "CVE-2026-28829"
    },
    {
      "cve": "CVE-2026-28831",
      "notes": [
        {
          "category": "description",
          "text": "An authorization vulnerability allowing applications to access sensitive user data was resolved by enhancing state management in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28831 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28831.json"
        }
      ],
      "title": "CVE-2026-28831"
    },
    {
      "cve": "CVE-2026-28832",
      "notes": [
        {
          "category": "description",
          "text": "An out-of-bounds read vulnerability in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4 was fixed by improving bounds checking to prevent potential kernel memory disclosure by applications.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28832 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28832.json"
        }
      ],
      "title": "CVE-2026-28832"
    },
    {
      "cve": "CVE-2026-28833",
      "notes": [
        {
          "category": "description",
          "text": "A permissions issue allowing apps to enumerate a user\u2019s installed applications was fixed by implementing additional restrictions in iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28833 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28833.json"
        }
      ],
      "title": "CVE-2026-28833"
    },
    {
      "cve": "CVE-2026-28834",
      "notes": [
        {
          "category": "description",
          "text": "A race condition causing potential unexpected system termination was fixed in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4 by improving state handling to address the issue.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28834 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28834.json"
        }
      ],
      "title": "CVE-2026-28834"
    },
    {
      "cve": "CVE-2026-28835",
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free vulnerability in SMB network share mounting was fixed in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4, addressing a memory management flaw that could cause system termination.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28835 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28835.json"
        }
      ],
      "title": "CVE-2026-28835"
    },
    {
      "cve": "CVE-2026-28837",
      "notes": [
        {
          "category": "description",
          "text": "macOS Tahoe 26.4 addressed a logic flaw that previously allowed applications to improperly access sensitive user data by implementing enhanced validation checks.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28837 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28837.json"
        }
      ],
      "title": "CVE-2026-28837"
    },
    {
      "cve": "CVE-2026-28838",
      "notes": [
        {
          "category": "description",
          "text": "A permissions issue allowing an app to potentially escape its sandbox was fixed by implementing additional sandbox restrictions in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28838 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28838.json"
        }
      ],
      "title": "CVE-2026-28838"
    },
    {
      "cve": "CVE-2026-28839",
      "notes": [
        {
          "category": "description",
          "text": "An issue allowing applications to access sensitive user data was resolved through enhanced verification mechanisms in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28839 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28839.json"
        }
      ],
      "title": "CVE-2026-28839"
    },
    {
      "cve": "CVE-2026-28841",
      "notes": [
        {
          "category": "description",
          "text": "A buffer overflow vulnerability in macOS Tahoe 26.4 was addressed by enhancing size validation to prevent potential memory corruption and application crashes.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28841 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28841.json"
        }
      ],
      "title": "CVE-2026-28841"
    },
    {
      "cve": "CVE-2026-28842",
      "notes": [
        {
          "category": "description",
          "text": "The buffer overflow vulnerability causing memory corruption and application termination was addressed in macOS Tahoe 26.4 through enhanced bounds checking.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28842 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28842.json"
        }
      ],
      "title": "CVE-2026-28842"
    },
    {
      "cve": "CVE-2026-28844",
      "notes": [
        {
          "category": "description",
          "text": "An input validation vulnerability in macOS Tahoe 26.4 was addressed, preventing unauthorized access to the file system.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28844 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28844.json"
        }
      ],
      "title": "CVE-2026-28844"
    },
    {
      "cve": "CVE-2026-28845",
      "notes": [
        {
          "category": "description",
          "text": "An authorization vulnerability in macOS Tahoe 26.4 was addressed by enhancing state management to prevent unauthorized access to protected user data.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28845 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28845.json"
        }
      ],
      "title": "CVE-2026-28845"
    },
    {
      "cve": "CVE-2026-28852",
      "notes": [
        {
          "category": "description",
          "text": "A stack overflow vulnerability allowing denial-of-service was fixed by improving input validation across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28852 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28852.json"
        }
      ],
      "title": "CVE-2026-28852"
    },
    {
      "cve": "CVE-2026-28857",
      "notes": [
        {
          "category": "description",
          "text": "Improved memory handling in Safari 26.4, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4 fixed an issue where processing maliciously crafted web content could cause unexpected process crashes.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28857 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28857.json"
        }
      ],
      "title": "CVE-2026-28857"
    },
    {
      "cve": "CVE-2026-28859",
      "notes": [
        {
          "category": "description",
          "text": "A memory handling vulnerability in Safari 26.4 and related OS versions was fixed, preventing malicious websites from processing restricted web content outside the sandbox environment.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28859 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28859.json"
        }
      ],
      "title": "CVE-2026-28859"
    },
    {
      "cve": "CVE-2026-28861",
      "notes": [
        {
          "category": "description",
          "text": "A logic issue in state management was fixed across multiple Apple operating systems to prevent malicious websites from accessing script message handlers intended for other origins.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28861 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28861.json"
        }
      ],
      "title": "CVE-2026-28861"
    },
    {
      "cve": "CVE-2026-28862",
      "notes": [
        {
          "category": "description",
          "text": "macOS updates Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4 enhance private data redaction in log entries to prevent applications from accessing sensitive user information.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28862 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28862.json"
        }
      ],
      "title": "CVE-2026-28862"
    },
    {
      "cve": "CVE-2026-28864",
      "notes": [
        {
          "category": "description",
          "text": "Apple addressed a vulnerability in iOS, iPadOS, macOS, visionOS, and watchOS by enhancing permissions checks to prevent local attackers from accessing users\u0027 Keychain items.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28864 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28864.json"
        }
      ],
      "title": "CVE-2026-28864"
    },
    {
      "cve": "CVE-2026-28865",
      "notes": [
        {
          "category": "description",
          "text": "An authentication vulnerability in multiple Apple operating systems was addressed by improving state management to prevent attackers in privileged network positions from intercepting network traffic.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28865 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28865.json"
        }
      ],
      "title": "CVE-2026-28865"
    },
    {
      "cve": "CVE-2026-28866",
      "notes": [
        {
          "category": "description",
          "text": "Multiple Apple operating systems including iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, iPadOS 26.4, and various macOS versions addressed a vulnerability where improper symlink validation allowed apps to access sensitive user data.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28866 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28866.json"
        }
      ],
      "title": "CVE-2026-28866"
    },
    {
      "cve": "CVE-2026-28867",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability allowing apps to potentially leak sensitive kernel state was fixed through improved authentication in multiple Apple operating systems including iOS 18.7.7, iPadOS 18.7.7, and macOS Sequoia 15.7.5.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28867 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28867.json"
        }
      ],
      "title": "CVE-2026-28867"
    },
    {
      "cve": "CVE-2026-28868",
      "notes": [
        {
          "category": "description",
          "text": "A logging issue in multiple Apple operating systems including iOS, iPadOS, macOS, visionOS, and watchOS was fixed by improving data redaction to prevent apps from disclosing kernel memory.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28868 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28868.json"
        }
      ],
      "title": "CVE-2026-28868"
    },
    {
      "cve": "CVE-2026-28870",
      "notes": [
        {
          "category": "description",
          "text": "An information leakage vulnerability allowing unauthorized access to sensitive user data was fixed through additional validation in iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28870 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28870.json"
        }
      ],
      "title": "CVE-2026-28870"
    },
    {
      "cve": "CVE-2026-28871",
      "notes": [
        {
          "category": "description",
          "text": "A logic issue in Safari, iOS, iPadOS, and macOS was fixed through improved checks to prevent cross-site scripting attacks from malicious websites.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28871 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28871.json"
        }
      ],
      "title": "CVE-2026-28871"
    },
    {
      "cve": "CVE-2026-28876",
      "notes": [
        {
          "category": "description",
          "text": "A parsing issue in directory path handling was fixed by improving path validation across multiple OS versions to prevent unauthorized app access to sensitive user data.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28876 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28876.json"
        }
      ],
      "title": "CVE-2026-28876"
    },
    {
      "cve": "CVE-2026-28877",
      "notes": [
        {
          "category": "description",
          "text": "An authorization vulnerability allowing apps to potentially access sensitive user data was resolved by enhancing state management in iOS 26.4, iPadOS 26.4, macOS Sequoia 15.7.5, macOS Tahoe 26.4, visionOS 26.4, and watchOS 26.4.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28877 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28877.json"
        }
      ],
      "title": "CVE-2026-28877"
    },
    {
      "cve": "CVE-2026-28878",
      "notes": [
        {
          "category": "description",
          "text": "Apple addressed a privacy vulnerability that allowed apps to enumerate installed applications by removing sensitive data in updates to iOS 18.7.7, iPadOS 18.7.7, macOS Sonoma 14.8.5, and other operating systems.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28878 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28878.json"
        }
      ],
      "title": "CVE-2026-28878"
    },
    {
      "cve": "CVE-2026-28879",
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free vulnerability causing potential process crashes when handling malicious web content was fixed through improved memory management in multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28879 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28879.json"
        }
      ],
      "title": "CVE-2026-28879"
    },
    {
      "cve": "CVE-2026-28880",
      "notes": [
        {
          "category": "description",
          "text": "Multiple Apple operating systems including iOS, iPadOS, macOS, and visionOS addressed a permissions issue by implementing additional restrictions to prevent apps from enumerating a user\u2019s installed applications.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28880 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28880.json"
        }
      ],
      "title": "CVE-2026-28880"
    },
    {
      "cve": "CVE-2026-28881",
      "notes": [
        {
          "category": "description",
          "text": "macOS Tahoe 26.4 fixed a privacy vulnerability by relocating sensitive user data to prevent unauthorized app access.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28881 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28881.json"
        }
      ],
      "title": "CVE-2026-28881"
    },
    {
      "cve": "CVE-2026-28882",
      "notes": [
        {
          "category": "description",
          "text": "An issue allowing apps to enumerate a user\u0027s installed applications was resolved through enhanced verification mechanisms in iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, and watchOS 26.4.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28882 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28882.json"
        }
      ],
      "title": "CVE-2026-28882"
    },
    {
      "cve": "CVE-2026-28886",
      "notes": [
        {
          "category": "description",
          "text": "A null pointer dereference vulnerability allowing a privileged network user to cause denial-of-service was fixed via improved input validation in multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28886 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28886.json"
        }
      ],
      "title": "CVE-2026-28886"
    },
    {
      "cve": "CVE-2026-28888",
      "notes": [
        {
          "category": "description",
          "text": "A race condition vulnerability allowing an application to potentially gain root privileges was fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4 by improving state handling.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28888 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28888.json"
        }
      ],
      "title": "CVE-2026-28888"
    },
    {
      "cve": "CVE-2026-28891",
      "notes": [
        {
          "category": "description",
          "text": "A race condition vulnerability allowing an application to potentially escape its sandbox was fixed through additional validation in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28891 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28891.json"
        }
      ],
      "title": "CVE-2026-28891"
    },
    {
      "cve": "CVE-2026-28892",
      "notes": [
        {
          "category": "description",
          "text": "A permissions vulnerability allowing applications to modify protected file system areas was fixed by removing vulnerable code in macOS Sequoia 15.7.5, Sonoma 14.8.5, and Tahoe 26.4.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28892 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28892.json"
        }
      ],
      "title": "CVE-2026-28892"
    },
    {
      "cve": "CVE-2026-28893",
      "notes": [
        {
          "category": "description",
          "text": "A privacy vulnerability involving the handling of temporary files during print preview was addressed in the macOS Tahoe 26.4 update.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28893 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28893.json"
        }
      ],
      "title": "CVE-2026-28893"
    },
    {
      "cve": "CVE-2026-28894",
      "notes": [
        {
          "category": "description",
          "text": "A denial-of-service vulnerability in iOS 26.4, iPadOS 26.4, and multiple macOS versions was addressed by improved input validation to prevent remote attackers from causing service disruptions.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-28894 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28894.json"
        }
      ],
      "title": "CVE-2026-28894"
    }
  ]
}