CVE Intelligence

Apple vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Apple products: 1197 record(s), with severity, exploitation and fixes.

Macos 1051Iphone Os 692Ipados 671iOS and iPadOS 670Visionos 449Watchos 424Tvos 390Safari 179Mac Os X 57iOS 18Xcode 10Icloud 6Itunes 5Container 4Swiftnio Http/2 3iOS-1 2macOS Monterey 2Containerization 2Swift-crypto 2Private Cloud Compute Server Software 1Swiftnio Ssh 1Swiftnio 1Servicetalk 1Swiftnio Ssl 1Mac Os X Server 1macOS Tahoe 1macOS Sonoma 1macOS Sequoia 1watchOS-1 1iTunes for Windows 1Pages 1Keynote 1iCloud for Windows 1Compressor 1Private Cloud Compute 1Safari (v and ) 1Os X Server 1

Exploited only (KEV) →

CVE-2026-28911 Critical · 9.8 CWE-119 Jul 27, 2026
Buffer Errors (Improper Restriction of Operations within Memory Bounds) in Apple Macos
The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to corrupt memory of a system process.
CVE-2026-28900 Medium · 5.5 CWE-290 Jul 27, 2026
Authentication Bypass by Spoofing in Apple Macos
A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.
CVE-2026-28896 High · 7.7 CWE-119 Jul 27, 2026
Buffer Errors (Improper Restriction of Operations within Memory Bounds) in Apple Macos
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An attacker may be able to cause unexpected system termination or read kernel memory.
CVE-2026-28849 Medium · 5.5 CWE-290 Jul 27, 2026
Authentication Bypass by Spoofing in Apple Macos
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5. A maliciously crafted ZIP archive may bypass Gatekeeper checks.
CVE-2026-20672 Medium · 5.5 CWE-200 Jul 27, 2026
Exposure of Sensitive Information in Apple Macos
An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.3. An app may be able to access sensitive user data.
CVE-2026-64785 Medium · 5.3 CWE-444 Jul 23, 2026
HTTP Request Smuggling in Apple Swiftnio Http/2
SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0.
CVE-2026-43823 High · 7.5 CWE-415 Jul 23, 2026
Double Free in Apple Swift-crypto
When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes provided. This vulnerability is addressed in swift-crypto version 4.5.1.
CVE-2026-43820 High · 7.7 CWE-125 Jul 23, 2026
Out-of-bounds Read in Apple Swiftnio Ssl
NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1_STRING, but not all SANs are backed by ASN1_STRING, so accessing the buffer for such a type can lead to out-of-bounds memory access. This vulnerability is addressed in swift-nio-ssl version 2.37.2.
CVE-2026-43746 Medium · 6.5 CWE-416 Jun 29, 2026
Use After Free in Apple Safari
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVE-2026-43745 Medium · 6.5 CWE-787 Jun 29, 2026
Out-of-bounds Write in Apple Safari
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVE-2026-43743 Medium · 4.7 CWE-362 Jun 29, 2026
Race Condition in Apple Ipados
A race condition was addressed with improved state handling. This issue is fixed in iOS 26.5.2 and iPadOS 26.5.2, iOS 26.7 and iPadOS 26.7, macOS Tahoe 26.5.2, macOS Tahoe 26.7, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination.
CVE-2026-43742 Medium · 6.5 CWE-416 Jun 29, 2026
Use After Free in Apple Safari
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2026-43740 Medium · 6.5 CWE-119 Jun 29, 2026
Buffer Errors (Improper Restriction of Operations within Memory Bounds) in Apple Safari
The issue was addressed with improved memory handling. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may result in the disclosure of process memory.
CVE-2026-43735 High · 8.1 CWE-352 Jun 29, 2026
Cross-Site Request Forgery (CSRF) in Apple Safari
The issue was addressed with improved checks. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may exfiltrate data cross-origin.
CVE-2026-43734 Medium · 6.5 CWE-416 Jun 29, 2026
Use After Free in Apple Safari
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2026-43732 Medium · 6.5 CWE-22 Jun 29, 2026
Path Traversal in Apple Safari
A path handling issue was addressed with improved validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may disclose sensitive user information.
CVE-2026-43731 High · 8.8 CWE-416 Jun 29, 2026
Use After Free in Apple Safari
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to memory corruption.
CVE-2026-43727 Medium · 6.5 CWE-416 Jun 29, 2026
Use After Free in Apple Safari
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVE-2026-43726 Medium · 6.5 CWE-416 Jun 29, 2026
Use After Free in Apple Safari
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected process crash.
CVE-2026-43725 High · 7.1 CWE-20 Jun 29, 2026
Improper Input Validation in Apple Safari
The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to process restricted web content outside the sandbox.
CVE-2026-43724 High · 7.8 CWE-20 Jun 29, 2026
Improper Input Validation in Apple Ipados
The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination or write kernel memory.
CVE-2026-43722 Medium · 5.5 CWE-20 Jun 29, 2026
Improper Input Validation in Apple Ipados
The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5.2. An app may be able to leak sensitive kernel state.
CVE-2026-43721 Medium · 6.5 CWE-732 Jun 29, 2026
Incorrect Permission Assignment for Critical Resource in Apple Safari
This issue was addressed through improved state management. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to silently hijack clipboard data.
CVE-2026-43720 Medium · 6.5 CWE-416 Jun 29, 2026
Use After Free in Apple Safari
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
CVE-2026-43718 Medium · 6.5 CWE-121 Jun 29, 2026
Stack-based Buffer Overflow in Apple Safari
A stack overflow was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.