NCSC-2026-0370
Vulnerability from csaf_ncscnl - Published: 2026-09-15 15:41 - Updated: 2026-09-15 15:41An authentication vulnerability in the Sign In With Apple flow was resolved by enhancing state management across iOS 27, iPadOS 27, and multiple macOS versions to prevent unauthorized access to user Apple accounts.
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Apple / iOS
|
vers:unknown/* | ||
|
vers:unknown/*
Apple / iPadOS
|
vers:unknown/* |
An out-of-bounds write vulnerability causing unexpected app termination was addressed through improved bounds checking in Apple operating systems including iOS, iPadOS, macOS, tvOS, and visionOS versions 26.7, 27, and related updates.
An out-of-bounds write vulnerability causing potential system termination or kernel memory corruption was addressed by Apple through enhanced bounds checking in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.
A use after free vulnerability affecting multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS was fixed to prevent apps from causing unexpected system termination.
A buffer overflow vulnerability affecting multiple Apple operating systems, including iOS, was fixed by enhancing memory handling to prevent process memory corruption from maliciously crafted images.
An app vulnerability allowing potential access to sensitive user data was addressed with enhanced data protection across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, and watchOS versions 26.7 through 27.
An authentication vulnerability in iOS 27 and iPadOS 27 allowed attackers with physical access to view Wi-Fi passwords without authentication, which was resolved by improved state management.
A use-after-free vulnerability causing potential system termination or kernel memory corruption was addressed via improved memory management in iOS 26.7, iPadOS 26.7, macOS Golden Gate 27, and macOS Sequoia 15.8.
A use-after-free vulnerability causing kernel memory corruption when connecting to malicious NFS servers was fixed in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.
Apple fixed a kernel memory disclosure vulnerability related to malicious NFS server connections across multiple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7 and 27.
A memory corruption vulnerability causing unexpected app termination via malicious files was fixed by improved input validation in iOS 27, iPadOS 27, and macOS Golden Gate 27.
A permissions vulnerability allowing malicious apps to gain root privileges was addressed with enhanced restrictions in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Golden Gate 27, and visionOS 27.
An authorization flaw allowing potential exposure of sensitive user data was addressed through enhanced state management across multiple Apple operating systems including iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.
A memory handling vulnerability causing potential app termination or memory corruption when processing malicious video files has been resolved in multiple Apple OS versions including iOS, iPadOS, macOS, tvOS, and watchOS 26.6 and 26.7 releases.
Multiple use-after-free vulnerabilities in WebKitGTK, Safari, and related OS versions were fixed to prevent memory corruption, crashes, data leaks, and arbitrary JavaScript execution caused by malicious web content.
An authorization vulnerability allowing unauthorized access to motion data from headphones without user consent was resolved through enhanced validation across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, and watchOS.
A memory handling vulnerability causing potential process memory disclosure via malicious asset catalogs was fixed in iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8.
A race condition was resolved through improved state handling across multiple Apple operating systems, preventing applications from causing unexpected system termination.
A permissions vulnerability in Apple operating systems including iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, and visionOS 27 allowed applications to modify files despite having only read access, which has been fixed.
A use-after-free vulnerability in Safari and related Apple OS versions was fixed by improving memory management to prevent crashes caused by maliciously crafted web content.
A memory corruption vulnerability enabling arbitrary code execution via crafted images was resolved by removing vulnerable code in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27.
A permissions vulnerability in Safari 27 and related OS versions was fixed by removing vulnerable code that could lead to the disclosure of sensitive user information from maliciously crafted web content.
A path handling vulnerability allowing unauthorized access to user-sensitive data was addressed through enhanced validation in iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.
An issue causing unexpected application termination when processing maliciously crafted files was resolved through improved bounds checks in multiple Apple operating systems version 26.6.
An information leakage vulnerability allowing apps to leak sensitive kernel state was addressed with additional validation in multiple Apple operating systems including iOS, iPadOS, macOS Golden Gate, tvOS, visionOS, and watchOS versions 18.7.10 and 27.
In iOS 27 and iPadOS 27, a privacy vulnerability allowing apps to identify other installed apps was resolved by enhancing the handling of user preferences to prevent unauthorized app detection.
An authentication vulnerability in IPSec was fixed through improved state management in iOS 26.6.1, iPadOS 26.6.1, iOS 27, and iPadOS 27 to prevent attackers in privileged network positions from bypassing authentication and intercepting traffic.
An out-of-bounds write vulnerability in Apple operating systems including iOS, iPadOS, macOS, tvOS, and visionOS versions 26.7 and 27 was addressed by improved bounds checking to prevent unexpected app termination from malicious video files.
A permissions vulnerability allowing unauthorized app access to user-sensitive data was addressed with enhanced restrictions in iOS 26.7 and 27, iPadOS 26.7 and 27, and multiple macOS versions including Golden Gate 27, Sequoia 15.8, and Tahoe 26.7.
A permissions vulnerability allowing unauthorized modification of protected file system areas was resolved in iOS 26.7 and 27, iPadOS 26.7 and 27, and multiple macOS versions including Golden Gate 27, Sequoia 15.8, and Tahoe 26.7.
A permissions vulnerability allowing malicious apps to escape their sandbox was addressed with enhanced restrictions in iOS 27, iPadOS 27, and macOS Golden Gate 27.
A race condition causing potential unexpected system termination was resolved through enhanced state management across multiple Apple operating systems including iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.
An out-of-bounds read vulnerability in multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7 and 27 was fixed by improving bounds checking to prevent system termination or kernel memory exposure.
A race condition vulnerability causing potential unexpected system termination was resolved through enhanced state management across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.
A memory corruption vulnerability causing unexpected system termination was addressed through enhanced memory handling in multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.
An out-of-bounds write vulnerability causing potential memory corruption was addressed through enhanced bounds checking in Apple operating systems including iOS, iPadOS, macOS, tvOS, and visionOS versions 26.7, 27, and related updates.
An out-of-bounds access vulnerability causing potential system termination or kernel memory corruption has been addressed with enhanced bounds checking in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
A file quarantine bypass vulnerability allowing archives to circumvent Gatekeeper was fixed with additional checks across multiple Apple operating systems including iOS, iPadOS, macOS, visionOS, and watchOS.
A use-after-free vulnerability causing unexpected system termination was addressed through enhanced memory management in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.
An issue allowing apps to potentially access sensitive user data was resolved through enhanced validation checks in iOS 26.7+, iPadOS 26.7+, macOS Golden Gate 27, Sequoia 15.8, Tahoe 26.7, visionOS 27, and watchOS 27.
An authorization vulnerability affecting multiple Apple OS versions was fixed to prevent malicious applications from bypassing Privacy preferences and gaining unauthorized access to state management.
A memory initialization vulnerability allowing apps to infer kernel memory layout was addressed in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and 15.8.
A logic flaw allowing unauthorized app access to sensitive user data was resolved through enhanced validation in Apple’s iOS, iPadOS, macOS, tvOS, and visionOS versions 26.7, 27, and related updates.
A use after free vulnerability in multiple Apple operating systems was fixed through enhanced memory management, preventing applications from causing unexpected system termination.
An integer overflow vulnerability was addressed by enhancing input validation across multiple OS versions, preventing applications from causing unexpected system termination.
A type confusion vulnerability causing denial of service was addressed by Apple through enhanced memory handling across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.
An issue causing unexpected system termination by an app was resolved through improved checks across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7 and 27.
A path handling vulnerability allowing modification of protected file system areas was addressed through enhanced validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27.
A null pointer dereference vulnerability causing potential denial-of-service during web content processing was fixed by improving input validation across multiple Apple operating systems.
An out-of-bounds write vulnerability in multiple Apple operating systems was addressed by enhancing bounds checking, preventing remote attackers from causing application crashes or executing arbitrary code.
A race condition vulnerability allowing local users to cause unexpected system termination or read kernel memory has been fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 through enhanced validation.
An integer overflow vulnerability in multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7 and 27 was fixed by improving input validation to prevent process memory disclosure from malicious files.
A buffer overflow vulnerability in Apple operating systems including iOS, iPadOS, and macOS was addressed by enhancing bounds checking to prevent denial of service conditions.
A permissions vulnerability allowing unauthorized app access to sensitive user data was addressed with enhanced restrictions in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
A race condition vulnerability causing potential unexpected system termination was resolved through enhanced state management across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.
A buffer overflow vulnerability causing unexpected process termination when opening malicious files has been fixed through improved size validation in Apple operating systems including iOS, iPadOS, macOS, tvOS, and visionOS versions 26.7, 27, and related updates.
A race condition causing potential system termination or kernel memory corruption was resolved by enhancing state handling across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.
A heap buffer overflow vulnerability in iOS, iPadOS, and macOS could cause unexpected system termination when mounting a maliciously crafted volume, fixed by improved bounds checking.
An out-of-bounds write vulnerability in asset catalog processing was fixed with improved bounds checking across multiple Apple operating systems including iOS 27, macOS variants, and others.
Apple addressed a privacy vulnerability that allowed malicious apps to determine user location by enhancing private data redaction in log entries across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.
An issue allowing malicious websites to detect installed apps was resolved by Apple through improved state management in Safari 27, iOS 27, iPadOS 27, and macOS Golden Gate 27.
An out-of-bounds write vulnerability in multiple OS versions was fixed by enhancing bounds checking to prevent unexpected system termination when mounting disk images containing maliciously crafted files.
A use-after-free vulnerability causing unexpected system termination was addressed through enhanced memory management in multiple Apple operating systems including iOS, iPadOS, macOS, and visionOS.
An out-of-bounds write vulnerability was fixed by enhancing bounds checking across multiple Apple operating systems, preventing apps from causing unexpected system termination or writing to kernel memory.
An out-of-bounds read vulnerability in font processing was addressed through improved bounds checking across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, preventing unexpected application termination.
An out-of-bounds write vulnerability in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS was fixed by improving bounds checking to prevent unexpected process termination when processing malicious 3D scenes.
Apple fixed a logging vulnerability that could expose sensitive user data by enhancing data redaction across multiple operating systems including iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.
An information disclosure vulnerability related to kernel memory was addressed by Apple through enhanced memory management across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7 and 27.
An out-of-bounds write vulnerability due to improper bounds checking in NTLM input processing has been fixed in iOS 27, iPadOS 27, and macOS Golden Gate 27, preventing unexpected application termination.
An out-of-bounds read vulnerability in multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, and visionOS was fixed by improving input validation to prevent process termination or memory disclosure.
A cryptographic vulnerability in Apple operating systems was addressed by enhancing integrity checks to prevent privileged network attackers from modifying network traffic in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, and watchOS 27.
A path handling vulnerability in Apple operating systems including iOS, iPadOS, macOS, and visionOS versions 26.7, 27, and 15.8 allowed attackers to write arbitrary files via malicious archive extraction and has been fixed.
An out-of-bounds write vulnerability causing memory corruption when processing malicious 3D models has been fixed in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.
A logic flaw enabling apps to bypass network restrictions was resolved through enhanced validation in iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27.
A memory handling issue causing unexpected system termination was resolved in iOS 26.7 and 27, iPadOS 26.7 and 27, and multiple macOS versions including Golden Gate 27, Sequoia 15.8, and Tahoe 26.7.
An authorization flaw allowing potential unauthorized Bluetooth access was resolved by enhancing state management in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
A double free vulnerability causing potential system termination or kernel memory corruption was resolved in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates through enhanced memory management.
An uninitialized memory vulnerability in image processing was resolved across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates, preventing potential process memory disclosure.
A memory handling vulnerability allowing local attackers to cause system termination or kernel memory corruption has been addressed in iOS 26.7 and 27, iPadOS 26.7 and 27, and multiple macOS versions including Golden Gate 27, Sequoia 15.8, and Tahoe 26.7.
A buffer overflow vulnerability causing unexpected app termination when processing malicious images has been fixed with improved bounds checking in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
An out-of-bounds write vulnerability causing unexpected app termination when processing malicious files has been fixed with improved bounds checking across multiple Apple operating systems including iOS 27 and macOS variants.
A permissions issue allowing local apps to read a persistent account identifier was fixed by adding restrictions across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.
A use-after-free vulnerability causing potential unexpected system termination has been addressed in iOS 27 and iPadOS 27 through enhanced memory management.
An out-of-bounds read vulnerability in font processing that could disclose process memory has been fixed with enhanced bounds checking in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
An out-of-bounds read vulnerability in font processing was addressed by Apple through enhanced input validation across iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, preventing potential memory disclosure.
A path traversal vulnerability in iOS and iPadOS versions 26.7 and 27 allowed attackers with physical access to trust-paired devices to read and write arbitrary files, which was mitigated by improved path validation.
An authorization vulnerability in Apple operating systems allowed malicious shortcuts to send messages without user confirmation, fixed via improved state management in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
A type confusion vulnerability causing unexpected system termination was addressed through enhanced checks in multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.
A permissions vulnerability allowing unauthorized app access to sensitive user data has been addressed with enhanced restrictions in iOS 27, iPadOS 27, visionOS 27, and watchOS 27.
Apple has resolved a privacy vulnerability in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 that previously allowed apps to identify users across reinstalls by improving identifier management.
A race condition vulnerability was fixed through improved state management across multiple OS versions, preventing sandboxed applications from executing arbitrary code with kernel privileges.
A permissions vulnerability allowing applications to modify protected system files was resolved via enhanced path validation across multiple Apple operating systems including iOS 27, macOS variants, and others.
An out-of-bounds write vulnerability causing memory corruption when processing malicious 3D models has been fixed in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.
An authorization vulnerability allowing unauthorized access to persistent device identifiers was resolved across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and 15.8.
An authorization vulnerability allowing unauthorized app access to sensitive user data was resolved via enhanced state management in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, tvOS 27, and visionOS 27.
A type confusion vulnerability causing potential unexpected system termination was fixed by improving memory handling across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and 15.8.
An authorization vulnerability allowing unauthorized access to sensitive user data was resolved through enhanced state management across multiple Apple operating systems including iOS, iPadOS, macOS, and tvOS versions 26.7, 27, and 15.8.
An integer overflow vulnerability causing memory corruption when processing malicious 3D models was fixed via improved input validation in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.
An authorization vulnerability allowing unauthorized app access to sensitive user data was resolved in iOS 26.7 and 27, iPadOS 26.7 and 27, and multiple macOS versions including Golden Gate 27, Sequoia 15.8, and Tahoe 26.7.
A memory initialization vulnerability in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7 and 27 allowed apps with root privileges to read uninitialized kernel memory and has been fixed.
An authorization flaw enabling device fingerprinting by apps was resolved via enhanced state management in iOS 26.7, iPadOS 26.7, iOS 27, and iPadOS 27.
A permissions vulnerability allowing sandboxed applications to access restricted files was resolved via enhanced path validation in multiple Apple operating systems including iOS, iPadOS, macOS, and visionOS versions 26.7, 27, and related releases.
Apple fixed a permissions vulnerability that allowed apps to fingerprint users by implementing additional sandbox restrictions across iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27.
An information disclosure vulnerability in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS was addressed by improving state management to prevent apps from identifying other installed applications.
An authorization vulnerability allowing sandboxed applications to access the System Keychain was resolved by enhancing state management in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
Apple addressed a security issue in iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27 that allowed apps to potentially fingerprint users by implementing additional entitlement checks.
A race condition vulnerability causing potential unexpected system termination was resolved through enhanced state management across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.
A memory corruption vulnerability in multiple Apple operating systems was addressed by enhancing memory handling when processing maliciously crafted 3D models in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.
A logic issue in state management was fixed across multiple Apple operating systems to prevent unexpected process termination triggered by malicious web content.
An authorization flaw allowing unauthorized access to sensitive user data was addressed in iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27 through enhanced state management.
An out-of-bounds write vulnerability causing unexpected application termination when processing malicious images was addressed through improved bounds checking in iOS 26.7, iPadOS 26.7, and macOS Golden Gate 27.
A heap buffer overflow vulnerability causing unexpected app termination when processing malicious files has been fixed with improved bounds checking in multiple Apple operating systems including iOS, iPadOS, macOS Golden Gate, visionOS, and watchOS versions 26.7 and 27.
An out-of-bounds write vulnerability was addressed by enhancing bounds checking to prevent sandboxed processes from bypassing sandbox restrictions across multiple operating system versions.
iOS 27 and iPadOS 27 have implemented additional permission restrictions to address a vulnerability that previously allowed applications to access sensitive user data without proper authorization.
A denial-of-service vulnerability due to insufficient input validation was addressed in iOS 27 and iPadOS 27 to prevent remote attackers from causing service disruptions.
Apple implemented an improved certificate validation fix across multiple operating systems to prevent attackers with compromised intermediate certificate authorities from issuing certificates with arbitrary extended key usages.
An out-of-bounds write vulnerability in multiple Apple OS versions was fixed by enhancing bounds checking to prevent unexpected process termination caused by maliciously crafted images.
iOS 27, iPadOS 27, and visionOS 27 addressed a privacy vulnerability by enhancing file handling to prevent unauthorized app access to sensitive user data.
A permissions vulnerability allowing unauthorized app access to sensitive user data was addressed with enhanced restrictions in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, and watchOS 27.
An input validation vulnerability in iOS 27 and iPadOS 27 could allow an attacker within radio range to cause unexpected system termination, which has been addressed in the latest updates.
A path traversal vulnerability allowing modification of protected system files was addressed via improved input validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and watchOS 27.
A privacy vulnerability allowing apps to bypass certain Privacy preferences was addressed by removing sensitive data in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27.
A permissions vulnerability allowing local applications to read a persistent account identifier was resolved with enhanced restrictions across multiple Apple operating systems including iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.
A logic flaw in iOS 26.7, iPadOS 26.7, iOS 27, and iPadOS 27 allowed attackers with physical access to locked devices to view sensitive user information, which has been addressed in recent updates.
An entitlement check vulnerability causing denial-of-service was addressed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27 through additional security measures.
A permissions issue allowing apps to read the device name was fixed with additional restrictions in iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27.
An information disclosure vulnerability allowing local applications to access a persistent account identifier was resolved through improved state management in iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27.
Additional entitlement checks were implemented in Safari 27, iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Golden Gate 27, and visionOS 27 to prevent apps from potentially accessing sensitive user data.
A logic issue in Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 was fixed by improving state management to prevent universal cross-site scripting triggered by maliciously crafted webarchive files.
An out-of-bounds read vulnerability allowing disclosure of kernel memory was addressed via improved input validation in multiple Apple operating systems including iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.
A privacy vulnerability enabling unauthorized cross-app and cross-website user tracking was addressed by Apple through enhanced state management in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and watchOS 27.
A vulnerability allowing an app to delete credentials stored in Keychain was resolved by removing the vulnerable code in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27.
A memory corruption vulnerability due to insufficient input validation, causing potential unexpected system termination when connecting a malicious accessory, has been fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, and macOS Tahoe 26.7.
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Apple heeft meerdere kwetsbaarheden verholpen in iOS en iPadOS.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden betreffen diverse beveiligingsproblemen zoals authenticatiefouten, out-of-bounds schrijf- en leesfouten, use-after-free, buffer overflows, race conditions, permissie- en autorisatieproblemen, geheugenbeschadiging, informatielekken, logica- en validatiefouten, en privacy-gerelateerde zwakheden. Aanvallers kunnen deze kwetsbaarheden misbruiken om ongeautoriseerde toegang te verkrijgen tot gebruikersgegevens, systeeminstabiliteit te veroorzaken door onverwachte systeem- of applicatieafsluitingen, kernelgeheugen te lezen of te beschadigen, privileges te escaleren, sandbox-beperkingen te omzeilen, en netwerkverkeer te manipuleren. Sommige kwetsbaarheden kunnen leiden tot het uitlekken van gevoelige informatie zoals Wi-Fi-wachtwoorden, apparaatidentificatoren, en gebruikerslocaties. De problemen zijn aanwezig in kerncomponenten van de besturingssystemen en diverse subsysteemfuncties zoals bestandshandling, geheugenbeheer, authenticatieprocessen, en webcontentverwerking. De fixes zijn doorgevoerd via verbeterde validatie, strengere toegangscontroles, verbeterde geheugen- en state management, en het verwijderen van kwetsbare code.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Apple heeft updates uitgebracht voor iOS en iPadOS om de beschreven kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "general",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
},
{
"category": "general",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "general",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "general",
"text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"title": "CWE-362"
},
{
"category": "general",
"text": "Improper Resource Shutdown or Release",
"title": "CWE-404"
},
{
"category": "general",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "general",
"text": "External Control of Critical State Data",
"title": "CWE-642"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "general",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://support.apple.com/en-us/149034"
},
{
"category": "external",
"summary": "Reference",
"url": "https://support.apple.com/en-us/149041"
}
],
"title": "Kwetsbaarheden verholpen in Apple iOS en iPadOS",
"tracking": {
"current_release_date": "2026-09-15T15:41:20.689877Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0370",
"initial_release_date": "2026-09-15T15:41:20.689877Z",
"revision_history": [
{
"date": "2026-09-15T15:41:20.689877Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "iOS"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "iPadOS"
}
],
"category": "vendor",
"name": "Apple"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-20683",
"notes": [
{
"category": "description",
"text": "An authentication vulnerability in the Sign In With Apple flow was resolved by enhancing state management across iOS 27, iPadOS 27, and multiple macOS versions to prevent unauthorized access to user Apple accounts.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-20683 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-20683.json"
}
],
"title": "CVE-2026-20683"
},
{
"cve": "CVE-2026-28966",
"notes": [
{
"category": "description",
"text": "An out-of-bounds write vulnerability causing unexpected app termination was addressed through improved bounds checking in Apple operating systems including iOS, iPadOS, macOS, tvOS, and visionOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-28966 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28966.json"
}
],
"title": "CVE-2026-28966"
},
{
"cve": "CVE-2026-28968",
"notes": [
{
"category": "description",
"text": "An out-of-bounds write vulnerability causing potential system termination or kernel memory corruption was addressed by Apple through enhanced bounds checking in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-28968 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28968.json"
}
],
"title": "CVE-2026-28968"
},
{
"cve": "CVE-2026-28969",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "description",
"text": "A use after free vulnerability affecting multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS was fixed to prevent apps from causing unexpected system termination.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-28969 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-28969.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-28969"
},
{
"cve": "CVE-2026-43661",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"notes": [
{
"category": "other",
"text": "Stack-based Buffer Overflow",
"title": "CWE-121"
},
{
"category": "description",
"text": "A buffer overflow vulnerability affecting multiple Apple operating systems, including iOS, was fixed by enhancing memory handling to prevent process memory corruption from maliciously crafted images.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43661 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43661.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-43661"
},
{
"cve": "CVE-2026-43664",
"notes": [
{
"category": "description",
"text": "An app vulnerability allowing potential access to sensitive user data was addressed with enhanced data protection across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, and watchOS versions 26.7 through 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43664 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43664.json"
}
],
"title": "CVE-2026-43664"
},
{
"cve": "CVE-2026-43674",
"notes": [
{
"category": "description",
"text": "An authentication vulnerability in iOS 27 and iPadOS 27 allowed attackers with physical access to view Wi-Fi passwords without authentication, which was resolved by improved state management.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43674 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43674.json"
}
],
"title": "CVE-2026-43674"
},
{
"cve": "CVE-2026-43684",
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability causing potential system termination or kernel memory corruption was addressed via improved memory management in iOS 26.7, iPadOS 26.7, macOS Golden Gate 27, and macOS Sequoia 15.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43684 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43684.json"
}
],
"title": "CVE-2026-43684"
},
{
"cve": "CVE-2026-43686",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "description",
"text": "A use-after-free vulnerability causing kernel memory corruption when connecting to malicious NFS servers was fixed in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43686 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43686.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-43686"
},
{
"cve": "CVE-2026-43687",
"notes": [
{
"category": "description",
"text": "Apple fixed a kernel memory disclosure vulnerability related to malicious NFS server connections across multiple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7 and 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43687 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43687.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-43687"
},
{
"cve": "CVE-2026-43688",
"notes": [
{
"category": "description",
"text": "A memory corruption vulnerability causing unexpected app termination via malicious files was fixed by improved input validation in iOS 27, iPadOS 27, and macOS Golden Gate 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43688 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43688.json"
}
],
"title": "CVE-2026-43688"
},
{
"cve": "CVE-2026-43689",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "description",
"text": "A permissions vulnerability allowing malicious apps to gain root privileges was addressed with enhanced restrictions in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Golden Gate 27, and visionOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43689 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43689.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-43689"
},
{
"cve": "CVE-2026-43695",
"notes": [
{
"category": "description",
"text": "An authorization flaw allowing potential exposure of sensitive user data was addressed through enhanced state management across multiple Apple operating systems including iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43695 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43695.json"
}
],
"title": "CVE-2026-43695"
},
{
"cve": "CVE-2026-43702",
"notes": [
{
"category": "description",
"text": "A memory handling vulnerability causing potential app termination or memory corruption when processing malicious video files has been resolved in multiple Apple OS versions including iOS, iPadOS, macOS, tvOS, and watchOS 26.6 and 26.7 releases.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43702 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43702.json"
}
],
"title": "CVE-2026-43702"
},
{
"cve": "CVE-2026-43715",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "description",
"text": "Multiple use-after-free vulnerabilities in WebKitGTK, Safari, and related OS versions were fixed to prevent memory corruption, crashes, data leaks, and arbitrary JavaScript execution caused by malicious web content.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43715 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43715.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-43715"
},
{
"cve": "CVE-2026-43737",
"notes": [
{
"category": "description",
"text": "An authorization vulnerability allowing unauthorized access to motion data from headphones without user consent was resolved through enhanced validation across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, and watchOS.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43737 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43737.json"
}
],
"title": "CVE-2026-43737"
},
{
"cve": "CVE-2026-43738",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "description",
"text": "A memory handling vulnerability causing potential process memory disclosure via malicious asset catalogs was fixed in iOS 18.7.10, iPadOS 18.7.10, iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, and macOS Sonoma 14.8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43738 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43738.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-43738"
},
{
"cve": "CVE-2026-43743",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "other",
"text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"title": "CWE-362"
},
{
"category": "description",
"text": "A race condition was resolved through improved state handling across multiple Apple operating systems, preventing applications from causing unexpected system termination.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43743 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43743.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-43743"
},
{
"cve": "CVE-2026-43785",
"notes": [
{
"category": "description",
"text": "A permissions vulnerability in Apple operating systems including iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, and visionOS 27 allowed applications to modify files despite having only read access, which has been fixed.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43785 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43785.json"
}
],
"title": "CVE-2026-43785"
},
{
"cve": "CVE-2026-64718",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "description",
"text": "A use-after-free vulnerability in Safari and related Apple OS versions was fixed by improving memory management to prevent crashes caused by maliciously crafted web content.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-64718 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64718.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-64718"
},
{
"cve": "CVE-2026-64752",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "A memory corruption vulnerability enabling arbitrary code execution via crafted images was resolved by removing vulnerable code in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-64752 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64752.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-64752"
},
{
"cve": "CVE-2026-64753",
"notes": [
{
"category": "description",
"text": "A permissions vulnerability in Safari 27 and related OS versions was fixed by removing vulnerable code that could lead to the disclosure of sensitive user information from maliciously crafted web content.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-64753 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64753.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-64753"
},
{
"cve": "CVE-2026-64756",
"notes": [
{
"category": "description",
"text": "A path handling vulnerability allowing unauthorized access to user-sensitive data was addressed through enhanced validation in iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, and macOS Tahoe 26.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-64756 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64756.json"
}
],
"title": "CVE-2026-64756"
},
{
"cve": "CVE-2026-64758",
"notes": [
{
"category": "description",
"text": "An issue causing unexpected application termination when processing maliciously crafted files was resolved through improved bounds checks in multiple Apple operating systems version 26.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-64758 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64758.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-64758"
},
{
"cve": "CVE-2026-64760",
"notes": [
{
"category": "description",
"text": "An information leakage vulnerability allowing apps to leak sensitive kernel state was addressed with additional validation in multiple Apple operating systems including iOS, iPadOS, macOS Golden Gate, tvOS, visionOS, and watchOS versions 18.7.10 and 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-64760 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64760.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-64760"
},
{
"cve": "CVE-2026-64761",
"notes": [
{
"category": "description",
"text": "In iOS 27 and iPadOS 27, a privacy vulnerability allowing apps to identify other installed apps was resolved by enhancing the handling of user preferences to prevent unauthorized app detection.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-64761 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-64761.json"
}
],
"title": "CVE-2026-64761"
},
{
"cve": "CVE-2026-65329",
"notes": [
{
"category": "description",
"text": "An authentication vulnerability in IPSec was fixed through improved state management in iOS 26.6.1, iPadOS 26.6.1, iOS 27, and iPadOS 27 to prevent attackers in privileged network positions from bypassing authentication and intercepting traffic.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65329 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65329.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-65329"
},
{
"cve": "CVE-2026-65344",
"notes": [
{
"category": "description",
"text": "An out-of-bounds write vulnerability in Apple operating systems including iOS, iPadOS, macOS, tvOS, and visionOS versions 26.7 and 27 was addressed by improved bounds checking to prevent unexpected app termination from malicious video files.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65344 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65344.json"
}
],
"title": "CVE-2026-65344"
},
{
"cve": "CVE-2026-65345",
"notes": [
{
"category": "description",
"text": "A permissions vulnerability allowing unauthorized app access to user-sensitive data was addressed with enhanced restrictions in iOS 26.7 and 27, iPadOS 26.7 and 27, and multiple macOS versions including Golden Gate 27, Sequoia 15.8, and Tahoe 26.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65345 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65345.json"
}
],
"title": "CVE-2026-65345"
},
{
"cve": "CVE-2026-65348",
"notes": [
{
"category": "description",
"text": "A permissions vulnerability allowing unauthorized modification of protected file system areas was resolved in iOS 26.7 and 27, iPadOS 26.7 and 27, and multiple macOS versions including Golden Gate 27, Sequoia 15.8, and Tahoe 26.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65348 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65348.json"
}
],
"title": "CVE-2026-65348"
},
{
"cve": "CVE-2026-65354",
"notes": [
{
"category": "description",
"text": "A permissions vulnerability allowing malicious apps to escape their sandbox was addressed with enhanced restrictions in iOS 27, iPadOS 27, and macOS Golden Gate 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65354 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65354.json"
}
],
"title": "CVE-2026-65354"
},
{
"cve": "CVE-2026-65358",
"notes": [
{
"category": "description",
"text": "A race condition causing potential unexpected system termination was resolved through enhanced state management across multiple Apple operating systems including iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65358 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65358.json"
}
],
"title": "CVE-2026-65358"
},
{
"cve": "CVE-2026-65359",
"notes": [
{
"category": "description",
"text": "An out-of-bounds read vulnerability in multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7 and 27 was fixed by improving bounds checking to prevent system termination or kernel memory exposure.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65359 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65359.json"
}
],
"title": "CVE-2026-65359"
},
{
"cve": "CVE-2026-65360",
"notes": [
{
"category": "description",
"text": "A race condition vulnerability causing potential unexpected system termination was resolved through enhanced state management across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65360 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65360.json"
}
],
"title": "CVE-2026-65360"
},
{
"cve": "CVE-2026-65377",
"notes": [
{
"category": "description",
"text": "A memory corruption vulnerability causing unexpected system termination was addressed through enhanced memory handling in multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65377 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65377.json"
}
],
"title": "CVE-2026-65377"
},
{
"cve": "CVE-2026-65395",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "An out-of-bounds write vulnerability causing potential memory corruption was addressed through enhanced bounds checking in Apple operating systems including iOS, iPadOS, macOS, tvOS, and visionOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65395 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65395.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-65395"
},
{
"cve": "CVE-2026-65398",
"notes": [
{
"category": "description",
"text": "An out-of-bounds access vulnerability causing potential system termination or kernel memory corruption has been addressed with enhanced bounds checking in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65398 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65398.json"
}
],
"title": "CVE-2026-65398"
},
{
"cve": "CVE-2026-65399",
"notes": [
{
"category": "description",
"text": "A file quarantine bypass vulnerability allowing archives to circumvent Gatekeeper was fixed with additional checks across multiple Apple operating systems including iOS, iPadOS, macOS, visionOS, and watchOS.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65399 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65399.json"
}
],
"title": "CVE-2026-65399"
},
{
"cve": "CVE-2026-65402",
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability causing unexpected system termination was addressed through enhanced memory management in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65402 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65402.json"
}
],
"title": "CVE-2026-65402"
},
{
"cve": "CVE-2026-65403",
"notes": [
{
"category": "description",
"text": "An issue allowing apps to potentially access sensitive user data was resolved through enhanced validation checks in iOS 26.7+, iPadOS 26.7+, macOS Golden Gate 27, Sequoia 15.8, Tahoe 26.7, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65403 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65403.json"
}
],
"title": "CVE-2026-65403"
},
{
"cve": "CVE-2026-65404",
"notes": [
{
"category": "description",
"text": "An authorization vulnerability affecting multiple Apple OS versions was fixed to prevent malicious applications from bypassing Privacy preferences and gaining unauthorized access to state management.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65404 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65404.json"
}
],
"title": "CVE-2026-65404"
},
{
"cve": "CVE-2026-65405",
"notes": [
{
"category": "description",
"text": "A memory initialization vulnerability allowing apps to infer kernel memory layout was addressed in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and 15.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65405 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65405.json"
}
],
"title": "CVE-2026-65405"
},
{
"cve": "CVE-2026-65406",
"notes": [
{
"category": "description",
"text": "A logic flaw allowing unauthorized app access to sensitive user data was resolved through enhanced validation in Apple\u2019s iOS, iPadOS, macOS, tvOS, and visionOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65406 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65406.json"
}
],
"title": "CVE-2026-65406"
},
{
"cve": "CVE-2026-65407",
"notes": [
{
"category": "description",
"text": "A use after free vulnerability in multiple Apple operating systems was fixed through enhanced memory management, preventing applications from causing unexpected system termination.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65407 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65407.json"
}
],
"title": "CVE-2026-65407"
},
{
"cve": "CVE-2026-65408",
"notes": [
{
"category": "description",
"text": "An integer overflow vulnerability was addressed by enhancing input validation across multiple OS versions, preventing applications from causing unexpected system termination.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65408 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65408.json"
}
],
"title": "CVE-2026-65408"
},
{
"cve": "CVE-2026-65409",
"notes": [
{
"category": "description",
"text": "A type confusion vulnerability causing denial of service was addressed by Apple through enhanced memory handling across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65409 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65409.json"
}
],
"title": "CVE-2026-65409"
},
{
"cve": "CVE-2026-65410",
"notes": [
{
"category": "description",
"text": "An issue causing unexpected system termination by an app was resolved through improved checks across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7 and 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65410 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65410.json"
}
],
"title": "CVE-2026-65410"
},
{
"cve": "CVE-2026-65411",
"notes": [
{
"category": "description",
"text": "A path handling vulnerability allowing modification of protected file system areas was addressed through enhanced validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65411 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65411.json"
}
],
"title": "CVE-2026-65411"
},
{
"cve": "CVE-2026-65412",
"notes": [
{
"category": "description",
"text": "A null pointer dereference vulnerability causing potential denial-of-service during web content processing was fixed by improving input validation across multiple Apple operating systems.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65412 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65412.json"
}
],
"title": "CVE-2026-65412"
},
{
"cve": "CVE-2026-65414",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "An out-of-bounds write vulnerability in multiple Apple operating systems was addressed by enhancing bounds checking, preventing remote attackers from causing application crashes or executing arbitrary code.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65414 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65414.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-65414"
},
{
"cve": "CVE-2026-65415",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "other",
"text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"title": "CWE-362"
},
{
"category": "description",
"text": "A race condition vulnerability allowing local users to cause unexpected system termination or read kernel memory has been fixed in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 through enhanced validation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-65415 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-65415.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-65415"
},
{
"cve": "CVE-2026-84487",
"notes": [
{
"category": "description",
"text": "An integer overflow vulnerability in multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7 and 27 was fixed by improving input validation to prevent process memory disclosure from malicious files.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84487 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84487.json"
}
],
"title": "CVE-2026-84487"
},
{
"cve": "CVE-2026-84489",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "other",
"text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"title": "CWE-120"
},
{
"category": "description",
"text": "A buffer overflow vulnerability in Apple operating systems including iOS, iPadOS, and macOS was addressed by enhancing bounds checking to prevent denial of service conditions.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84489 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84489.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-84489"
},
{
"cve": "CVE-2026-84491",
"notes": [
{
"category": "description",
"text": "A permissions vulnerability allowing unauthorized app access to sensitive user data was addressed with enhanced restrictions in iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84491 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84491.json"
}
],
"title": "CVE-2026-84491"
},
{
"cve": "CVE-2026-84492",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "other",
"text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"title": "CWE-362"
},
{
"category": "description",
"text": "A race condition vulnerability causing potential unexpected system termination was resolved through enhanced state management across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84492 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84492.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-84492"
},
{
"cve": "CVE-2026-84497",
"notes": [
{
"category": "description",
"text": "A buffer overflow vulnerability causing unexpected process termination when opening malicious files has been fixed through improved size validation in Apple operating systems including iOS, iPadOS, macOS, tvOS, and visionOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84497 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84497.json"
}
],
"title": "CVE-2026-84497"
},
{
"cve": "CVE-2026-84507",
"notes": [
{
"category": "description",
"text": "A race condition causing potential system termination or kernel memory corruption was resolved by enhancing state handling across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84507 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84507.json"
}
],
"title": "CVE-2026-84507"
},
{
"cve": "CVE-2026-84510",
"notes": [
{
"category": "description",
"text": "A heap buffer overflow vulnerability in iOS, iPadOS, and macOS could cause unexpected system termination when mounting a maliciously crafted volume, fixed by improved bounds checking.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84510 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84510.json"
}
],
"title": "CVE-2026-84510"
},
{
"cve": "CVE-2026-84511",
"notes": [
{
"category": "description",
"text": "An out-of-bounds write vulnerability in asset catalog processing was fixed with improved bounds checking across multiple Apple operating systems including iOS 27, macOS variants, and others.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84511 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84511.json"
}
],
"title": "CVE-2026-84511"
},
{
"cve": "CVE-2026-84513",
"notes": [
{
"category": "description",
"text": "Apple addressed a privacy vulnerability that allowed malicious apps to determine user location by enhancing private data redaction in log entries across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84513 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84513.json"
}
],
"title": "CVE-2026-84513"
},
{
"cve": "CVE-2026-84518",
"cwe": {
"id": "CWE-642",
"name": "External Control of Critical State Data"
},
"notes": [
{
"category": "other",
"text": "External Control of Critical State Data",
"title": "CWE-642"
},
{
"category": "description",
"text": "An issue allowing malicious websites to detect installed apps was resolved by Apple through improved state management in Safari 27, iOS 27, iPadOS 27, and macOS Golden Gate 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84518 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84518.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-84518"
},
{
"cve": "CVE-2026-84519",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "An out-of-bounds write vulnerability in multiple OS versions was fixed by enhancing bounds checking to prevent unexpected system termination when mounting disk images containing maliciously crafted files.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84519 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84519.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-84519"
},
{
"cve": "CVE-2026-84521",
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability causing unexpected system termination was addressed through enhanced memory management in multiple Apple operating systems including iOS, iPadOS, macOS, and visionOS.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84521 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84521.json"
}
],
"title": "CVE-2026-84521"
},
{
"cve": "CVE-2026-84523",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "An out-of-bounds write vulnerability was fixed by enhancing bounds checking across multiple Apple operating systems, preventing apps from causing unexpected system termination or writing to kernel memory.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84523 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84523.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-84523"
},
{
"cve": "CVE-2026-84524",
"notes": [
{
"category": "description",
"text": "An out-of-bounds read vulnerability in font processing was addressed through improved bounds checking across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS, preventing unexpected application termination.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84524 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84524.json"
}
],
"title": "CVE-2026-84524"
},
{
"cve": "CVE-2026-84526",
"notes": [
{
"category": "description",
"text": "An out-of-bounds write vulnerability in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS was fixed by improving bounds checking to prevent unexpected process termination when processing malicious 3D scenes.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84526 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84526.json"
}
],
"title": "CVE-2026-84526"
},
{
"cve": "CVE-2026-84527",
"notes": [
{
"category": "description",
"text": "Apple fixed a logging vulnerability that could expose sensitive user data by enhancing data redaction across multiple operating systems including iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84527 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84527.json"
}
],
"title": "CVE-2026-84527"
},
{
"cve": "CVE-2026-84530",
"notes": [
{
"category": "description",
"text": "An information disclosure vulnerability related to kernel memory was addressed by Apple through enhanced memory management across iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7 and 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84530 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84530.json"
}
],
"title": "CVE-2026-84530"
},
{
"cve": "CVE-2026-84531",
"notes": [
{
"category": "description",
"text": "An out-of-bounds write vulnerability due to improper bounds checking in NTLM input processing has been fixed in iOS 27, iPadOS 27, and macOS Golden Gate 27, preventing unexpected application termination.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84531 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84531.json"
}
],
"title": "CVE-2026-84531"
},
{
"cve": "CVE-2026-84532",
"notes": [
{
"category": "description",
"text": "An out-of-bounds read vulnerability in multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, and visionOS was fixed by improving input validation to prevent process termination or memory disclosure.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84532 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84532.json"
}
],
"title": "CVE-2026-84532"
},
{
"cve": "CVE-2026-84533",
"notes": [
{
"category": "description",
"text": "A cryptographic vulnerability in Apple operating systems was addressed by enhancing integrity checks to prevent privileged network attackers from modifying network traffic in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84533 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84533.json"
}
],
"title": "CVE-2026-84533"
},
{
"cve": "CVE-2026-84534",
"notes": [
{
"category": "description",
"text": "A path handling vulnerability in Apple operating systems including iOS, iPadOS, macOS, and visionOS versions 26.7, 27, and 15.8 allowed attackers to write arbitrary files via malicious archive extraction and has been fixed.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84534 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84534.json"
}
],
"title": "CVE-2026-84534"
},
{
"cve": "CVE-2026-84546",
"notes": [
{
"category": "description",
"text": "An out-of-bounds write vulnerability causing memory corruption when processing malicious 3D models has been fixed in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84546 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84546.json"
}
],
"title": "CVE-2026-84546"
},
{
"cve": "CVE-2026-84551",
"notes": [
{
"category": "description",
"text": "A logic flaw enabling apps to bypass network restrictions was resolved through enhanced validation in iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84551 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84551.json"
}
],
"title": "CVE-2026-84551"
},
{
"cve": "CVE-2026-84552",
"notes": [
{
"category": "description",
"text": "A memory handling issue causing unexpected system termination was resolved in iOS 26.7 and 27, iPadOS 26.7 and 27, and multiple macOS versions including Golden Gate 27, Sequoia 15.8, and Tahoe 26.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84552 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84552.json"
}
],
"title": "CVE-2026-84552"
},
{
"cve": "CVE-2026-84560",
"notes": [
{
"category": "description",
"text": "An authorization flaw allowing potential unauthorized Bluetooth access was resolved by enhancing state management in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84560 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84560.json"
}
],
"title": "CVE-2026-84560"
},
{
"cve": "CVE-2026-84561",
"notes": [
{
"category": "description",
"text": "A double free vulnerability causing potential system termination or kernel memory corruption was resolved in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates through enhanced memory management.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84561 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84561.json"
}
],
"title": "CVE-2026-84561"
},
{
"cve": "CVE-2026-84564",
"notes": [
{
"category": "description",
"text": "An uninitialized memory vulnerability in image processing was resolved across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates, preventing potential process memory disclosure.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84564 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84564.json"
}
],
"title": "CVE-2026-84564"
},
{
"cve": "CVE-2026-84566",
"notes": [
{
"category": "description",
"text": "A memory handling vulnerability allowing local attackers to cause system termination or kernel memory corruption has been addressed in iOS 26.7 and 27, iPadOS 26.7 and 27, and multiple macOS versions including Golden Gate 27, Sequoia 15.8, and Tahoe 26.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84566 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84566.json"
}
],
"title": "CVE-2026-84566"
},
{
"cve": "CVE-2026-84571",
"notes": [
{
"category": "description",
"text": "A buffer overflow vulnerability causing unexpected app termination when processing malicious images has been fixed with improved bounds checking in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84571 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84571.json"
}
],
"title": "CVE-2026-84571"
},
{
"cve": "CVE-2026-84575",
"notes": [
{
"category": "description",
"text": "An out-of-bounds write vulnerability causing unexpected app termination when processing malicious files has been fixed with improved bounds checking across multiple Apple operating systems including iOS 27 and macOS variants.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84575 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84575.json"
}
],
"title": "CVE-2026-84575"
},
{
"cve": "CVE-2026-84583",
"notes": [
{
"category": "description",
"text": "A permissions issue allowing local apps to read a persistent account identifier was fixed by adding restrictions across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84583 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84583.json"
}
],
"title": "CVE-2026-84583"
},
{
"cve": "CVE-2026-84593",
"notes": [
{
"category": "description",
"text": "A use-after-free vulnerability causing potential unexpected system termination has been addressed in iOS 27 and iPadOS 27 through enhanced memory management.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84593 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84593.json"
}
],
"title": "CVE-2026-84593"
},
{
"cve": "CVE-2026-84596",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "description",
"text": "An out-of-bounds read vulnerability in font processing that could disclose process memory has been fixed with enhanced bounds checking in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84596 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84596.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-84596"
},
{
"cve": "CVE-2026-84597",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "description",
"text": "An out-of-bounds read vulnerability in font processing was addressed by Apple through enhanced input validation across iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27, preventing potential memory disclosure.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84597 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84597.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-84597"
},
{
"cve": "CVE-2026-84598",
"notes": [
{
"category": "description",
"text": "A path traversal vulnerability in iOS and iPadOS versions 26.7 and 27 allowed attackers with physical access to trust-paired devices to read and write arbitrary files, which was mitigated by improved path validation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84598 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84598.json"
}
],
"title": "CVE-2026-84598"
},
{
"cve": "CVE-2026-84600",
"notes": [
{
"category": "description",
"text": "An authorization vulnerability in Apple operating systems allowed malicious shortcuts to send messages without user confirmation, fixed via improved state management in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84600 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84600.json"
}
],
"title": "CVE-2026-84600"
},
{
"cve": "CVE-2026-84602",
"notes": [
{
"category": "description",
"text": "A type confusion vulnerability causing unexpected system termination was addressed through enhanced checks in multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84602 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84602.json"
}
],
"title": "CVE-2026-84602"
},
{
"cve": "CVE-2026-84603",
"notes": [
{
"category": "description",
"text": "A permissions vulnerability allowing unauthorized app access to sensitive user data has been addressed with enhanced restrictions in iOS 27, iPadOS 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84603 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84603.json"
}
],
"title": "CVE-2026-84603"
},
{
"cve": "CVE-2026-84606",
"notes": [
{
"category": "description",
"text": "Apple has resolved a privacy vulnerability in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 that previously allowed apps to identify users across reinstalls by improving identifier management.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84606 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84606.json"
}
],
"title": "CVE-2026-84606"
},
{
"cve": "CVE-2026-84607",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "other",
"text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"title": "CWE-362"
},
{
"category": "description",
"text": "A race condition vulnerability was fixed through improved state management across multiple OS versions, preventing sandboxed applications from executing arbitrary code with kernel privileges.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84607 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84607.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-84607"
},
{
"cve": "CVE-2026-84609",
"notes": [
{
"category": "description",
"text": "A permissions vulnerability allowing applications to modify protected system files was resolved via enhanced path validation across multiple Apple operating systems including iOS 27, macOS variants, and others.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84609 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84609.json"
}
],
"title": "CVE-2026-84609"
},
{
"cve": "CVE-2026-84611",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "An out-of-bounds write vulnerability causing memory corruption when processing malicious 3D models has been fixed in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84611 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84611.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-84611"
},
{
"cve": "CVE-2026-84612",
"notes": [
{
"category": "description",
"text": "An authorization vulnerability allowing unauthorized access to persistent device identifiers was resolved across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and 15.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84612 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84612.json"
}
],
"title": "CVE-2026-84612"
},
{
"cve": "CVE-2026-84615",
"notes": [
{
"category": "description",
"text": "An authorization vulnerability allowing unauthorized app access to sensitive user data was resolved via enhanced state management in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, tvOS 27, and visionOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84615 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84615.json"
}
],
"title": "CVE-2026-84615"
},
{
"cve": "CVE-2026-84616",
"notes": [
{
"category": "description",
"text": "A type confusion vulnerability causing potential unexpected system termination was fixed by improving memory handling across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and 15.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84616 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84616.json"
}
],
"title": "CVE-2026-84616"
},
{
"cve": "CVE-2026-84617",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"notes": [
{
"category": "other",
"text": "Incorrect Authorization",
"title": "CWE-863"
},
{
"category": "description",
"text": "An authorization vulnerability allowing unauthorized access to sensitive user data was resolved through enhanced state management across multiple Apple operating systems including iOS, iPadOS, macOS, and tvOS versions 26.7, 27, and 15.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84617 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84617.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-84617"
},
{
"cve": "CVE-2026-84620",
"notes": [
{
"category": "description",
"text": "An integer overflow vulnerability causing memory corruption when processing malicious 3D models was fixed via improved input validation in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84620 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84620.json"
}
],
"title": "CVE-2026-84620"
},
{
"cve": "CVE-2026-84621",
"notes": [
{
"category": "description",
"text": "An authorization vulnerability allowing unauthorized app access to sensitive user data was resolved in iOS 26.7 and 27, iPadOS 26.7 and 27, and multiple macOS versions including Golden Gate 27, Sequoia 15.8, and Tahoe 26.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84621 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84621.json"
}
],
"title": "CVE-2026-84621"
},
{
"cve": "CVE-2026-84622",
"notes": [
{
"category": "description",
"text": "A memory initialization vulnerability in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7 and 27 allowed apps with root privileges to read uninitialized kernel memory and has been fixed.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84622 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84622.json"
}
],
"title": "CVE-2026-84622"
},
{
"cve": "CVE-2026-84623",
"notes": [
{
"category": "description",
"text": "An authorization flaw enabling device fingerprinting by apps was resolved via enhanced state management in iOS 26.7, iPadOS 26.7, iOS 27, and iPadOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84623 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84623.json"
}
],
"title": "CVE-2026-84623"
},
{
"cve": "CVE-2026-84624",
"notes": [
{
"category": "description",
"text": "A permissions vulnerability allowing sandboxed applications to access restricted files was resolved via enhanced path validation in multiple Apple operating systems including iOS, iPadOS, macOS, and visionOS versions 26.7, 27, and related releases.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84624 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84624.json"
}
],
"title": "CVE-2026-84624"
},
{
"cve": "CVE-2026-84625",
"notes": [
{
"category": "description",
"text": "Apple fixed a permissions vulnerability that allowed apps to fingerprint users by implementing additional sandbox restrictions across iOS 27, iPadOS 27, macOS Golden Gate 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84625 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84625.json"
}
],
"title": "CVE-2026-84625"
},
{
"cve": "CVE-2026-84626",
"notes": [
{
"category": "description",
"text": "An information disclosure vulnerability in Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS was addressed by improving state management to prevent apps from identifying other installed applications.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84626 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84626.json"
}
],
"title": "CVE-2026-84626"
},
{
"cve": "CVE-2026-84628",
"notes": [
{
"category": "description",
"text": "An authorization vulnerability allowing sandboxed applications to access the System Keychain was resolved by enhancing state management in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84628 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84628.json"
}
],
"title": "CVE-2026-84628"
},
{
"cve": "CVE-2026-84629",
"notes": [
{
"category": "description",
"text": "Apple addressed a security issue in iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27 that allowed apps to potentially fingerprint users by implementing additional entitlement checks.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84629 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84629.json"
}
],
"title": "CVE-2026-84629"
},
{
"cve": "CVE-2026-84630",
"cwe": {
"id": "CWE-362",
"name": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)"
},
"notes": [
{
"category": "other",
"text": "Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"title": "CWE-362"
},
{
"category": "description",
"text": "A race condition vulnerability causing potential unexpected system termination was resolved through enhanced state management across multiple Apple operating systems including iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84630 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84630.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-84630"
},
{
"cve": "CVE-2026-84632",
"notes": [
{
"category": "description",
"text": "A memory corruption vulnerability in multiple Apple operating systems was addressed by enhancing memory handling when processing maliciously crafted 3D models in iOS, iPadOS, macOS, tvOS, visionOS, and watchOS versions 26.7, 27, and related updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84632 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84632.json"
}
],
"title": "CVE-2026-84632"
},
{
"cve": "CVE-2026-84635",
"notes": [
{
"category": "description",
"text": "A logic issue in state management was fixed across multiple Apple operating systems to prevent unexpected process termination triggered by malicious web content.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84635 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84635.json"
}
],
"title": "CVE-2026-84635"
},
{
"cve": "CVE-2026-84636",
"notes": [
{
"category": "description",
"text": "An authorization flaw allowing unauthorized access to sensitive user data was addressed in iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27 through enhanced state management.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-84636 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-84636.json"
}
],
"title": "CVE-2026-84636"
},
{
"cve": "CVE-2026-86869",
"notes": [
{
"category": "description",
"text": "An out-of-bounds write vulnerability causing unexpected application termination when processing malicious images was addressed through improved bounds checking in iOS 26.7, iPadOS 26.7, and macOS Golden Gate 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86869 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86869.json"
}
],
"title": "CVE-2026-86869"
},
{
"cve": "CVE-2026-86870",
"notes": [
{
"category": "description",
"text": "A heap buffer overflow vulnerability causing unexpected app termination when processing malicious files has been fixed with improved bounds checking in multiple Apple operating systems including iOS, iPadOS, macOS Golden Gate, visionOS, and watchOS versions 26.7 and 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86870 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86870.json"
}
],
"title": "CVE-2026-86870"
},
{
"cve": "CVE-2026-86876",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "An out-of-bounds write vulnerability was addressed by enhancing bounds checking to prevent sandboxed processes from bypassing sandbox restrictions across multiple operating system versions.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86876 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86876.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-86876"
},
{
"cve": "CVE-2026-86878",
"notes": [
{
"category": "description",
"text": "iOS 27 and iPadOS 27 have implemented additional permission restrictions to address a vulnerability that previously allowed applications to access sensitive user data without proper authorization.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86878 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86878.json"
}
],
"title": "CVE-2026-86878"
},
{
"cve": "CVE-2026-86879",
"notes": [
{
"category": "description",
"text": "A denial-of-service vulnerability due to insufficient input validation was addressed in iOS 27 and iPadOS 27 to prevent remote attackers from causing service disruptions.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86879 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86879.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-86879"
},
{
"cve": "CVE-2026-86881",
"notes": [
{
"category": "description",
"text": "Apple implemented an improved certificate validation fix across multiple operating systems to prevent attackers with compromised intermediate certificate authorities from issuing certificates with arbitrary extended key usages.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86881 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86881.json"
}
],
"title": "CVE-2026-86881"
},
{
"cve": "CVE-2026-86882",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "An out-of-bounds write vulnerability in multiple Apple OS versions was fixed by enhancing bounds checking to prevent unexpected process termination caused by maliciously crafted images.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86882 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86882.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-86882"
},
{
"cve": "CVE-2026-86883",
"notes": [
{
"category": "description",
"text": "iOS 27, iPadOS 27, and visionOS 27 addressed a privacy vulnerability by enhancing file handling to prevent unauthorized app access to sensitive user data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86883 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86883.json"
}
],
"title": "CVE-2026-86883"
},
{
"cve": "CVE-2026-86884",
"notes": [
{
"category": "description",
"text": "A permissions vulnerability allowing unauthorized app access to sensitive user data was addressed with enhanced restrictions in iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86884 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86884.json"
}
],
"title": "CVE-2026-86884"
},
{
"cve": "CVE-2026-86885",
"notes": [
{
"category": "description",
"text": "An input validation vulnerability in iOS 27 and iPadOS 27 could allow an attacker within radio range to cause unexpected system termination, which has been addressed in the latest updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86885 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86885.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-86885"
},
{
"cve": "CVE-2026-86886",
"notes": [
{
"category": "description",
"text": "A path traversal vulnerability allowing modification of protected system files was addressed via improved input validation in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86886 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86886.json"
}
],
"title": "CVE-2026-86886"
},
{
"cve": "CVE-2026-86887",
"notes": [
{
"category": "description",
"text": "A privacy vulnerability allowing apps to bypass certain Privacy preferences was addressed by removing sensitive data in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86887 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86887.json"
}
],
"title": "CVE-2026-86887"
},
{
"cve": "CVE-2026-86888",
"notes": [
{
"category": "description",
"text": "A permissions vulnerability allowing local applications to read a persistent account identifier was resolved with enhanced restrictions across multiple Apple operating systems including iOS 27, iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86888 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86888.json"
}
],
"title": "CVE-2026-86888"
},
{
"cve": "CVE-2026-86890",
"notes": [
{
"category": "description",
"text": "A logic flaw in iOS 26.7, iPadOS 26.7, iOS 27, and iPadOS 27 allowed attackers with physical access to locked devices to view sensitive user information, which has been addressed in recent updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86890 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86890.json"
}
],
"title": "CVE-2026-86890"
},
{
"cve": "CVE-2026-86892",
"notes": [
{
"category": "description",
"text": "An entitlement check vulnerability causing denial-of-service was addressed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27 through additional security measures.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86892 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86892.json"
}
],
"title": "CVE-2026-86892"
},
{
"cve": "CVE-2026-86893",
"notes": [
{
"category": "description",
"text": "A permissions issue allowing apps to read the device name was fixed with additional restrictions in iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86893 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86893.json"
}
],
"title": "CVE-2026-86893"
},
{
"cve": "CVE-2026-86895",
"notes": [
{
"category": "description",
"text": "An information disclosure vulnerability allowing local applications to access a persistent account identifier was resolved through improved state management in iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86895 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86895.json"
}
],
"title": "CVE-2026-86895"
},
{
"cve": "CVE-2026-86897",
"notes": [
{
"category": "description",
"text": "Additional entitlement checks were implemented in Safari 27, iOS 26.7 and 27, iPadOS 26.7 and 27, macOS Golden Gate 27, and visionOS 27 to prevent apps from potentially accessing sensitive user data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86897 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86897.json"
}
],
"title": "CVE-2026-86897"
},
{
"cve": "CVE-2026-86898",
"notes": [
{
"category": "description",
"text": "A logic issue in Safari 27, iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27 was fixed by improving state management to prevent universal cross-site scripting triggered by maliciously crafted webarchive files.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86898 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86898.json"
}
],
"title": "CVE-2026-86898"
},
{
"cve": "CVE-2026-86903",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Read",
"title": "CWE-125"
},
{
"category": "description",
"text": "An out-of-bounds read vulnerability allowing disclosure of kernel memory was addressed via improved input validation in multiple Apple operating systems including iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86903 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86903.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-86903"
},
{
"cve": "CVE-2026-86904",
"notes": [
{
"category": "description",
"text": "A privacy vulnerability enabling unauthorized cross-app and cross-website user tracking was addressed by Apple through enhanced state management in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and watchOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86904 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86904.json"
}
],
"title": "CVE-2026-86904"
},
{
"cve": "CVE-2026-86905",
"notes": [
{
"category": "description",
"text": "A vulnerability allowing an app to delete credentials stored in Keychain was resolved by removing the vulnerable code in iOS 27, iPadOS 27, macOS Golden Gate 27, and visionOS 27.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86905 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86905.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2"
]
}
],
"title": "CVE-2026-86905"
},
{
"cve": "CVE-2026-86924",
"notes": [
{
"category": "description",
"text": "A memory corruption vulnerability due to insufficient input validation, causing potential unexpected system termination when connecting a malicious accessory, has been fixed in iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, macOS Golden Gate 27, and macOS Tahoe 26.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-86924 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-86924.json"
}
],
"title": "CVE-2026-86924"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.