CVE Vulnerability Catalog

An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure.

A logic issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. Opening a maliciously crafted webarchive file may lead to universal cross-site scripting.

This issue was addressed with additional entitlement checks. This issue is fixed in Safari 27, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to access sensitive user data.

An information disclosure issue was addressed with improved state management. The issue affects iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27. A local app may be able to read a persistent account identifier.

A logic issue was addressed with improved checks. The issue affects macOS Golden Gate 27. An app may be able to break out of its sandbox.

A permissions issue was addressed with additional restrictions. The issue affects iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27. An app may be able to read device name.

This issue was addressed with additional entitlement checks. The issue affects iOS 26.7, iPadOS 26.7, iOS 27, iPadOS 27, and visionOS 27. An app may be able to cause a denial-of-service.

An authorization issue was addressed with improved state management. The issue affects macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and watchOS 27. An app may be able to access Bluetooth device information.

A logic issue was addressed with improved checks. The issue affects iOS 26.7, iPadOS 26.7, iOS 27, and iPadOS 27. An attacker with physical access to a locked device may be able to view sensitive user information.

A certificate validation issue was found in macOS and fixed with improved certificate validation. An attacker in a privileged network position may be able to intercept network traffic.

A permissions issue was found in Apple systems and fixed with additional restrictions. A local app may be able to read a persistent account identifier.

A privacy issue was found in Apple systems and fixed by removing sensitive data. An app may be able to bypass certain Privacy preferences.

A path traversal issue was found in Apple systems and fixed with improved input validation. An app may be able to modify protected system files.

An input validation issue was found in Apple systems and fixed with improved input validation. An attacker in radio range may be able to cause unexpected system termination.

A permissions issue was found in Apple systems and fixed with additional restrictions. An app may be able to access sensitive user data.

A privacy issue was found in Apple systems and fixed with improved handling of files. An app may be able to access sensitive user data.

An out-of-bounds write issue was found in Apple systems and fixed with improved bounds checking. Processing a maliciously crafted image may lead to unexpected process termination.

A certificate validation issue was found in Apple systems and fixed with improved certificate validation. An attacker with a compromised intermediate certificate authority may be able to issue certificates with arbitrary extended key usages.

A denial-of-service issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. A remote attacker may be able to cause a denial-of-service.

A permissions issue was found in Apple systems and fixed with additional restrictions. An app may be able to access sensitive user data.